Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 26 subscribers
  • Views 7219 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to correlate drop-packet-capture results with advanced firewall setup ?

Slawski

Has anybody know how to match specific "Invalid Traffic" log entries with "advanced-firewall" (CLI interface) ?

I would like to know if some of those log entries are caused by a little to strict firewall for home environment. Of course, it would be great if "Invalid Traffic" was accompanied by a code which tells why the firewall considers that traffic "invalid".



This thread was automatically locked due to age.
  • 0

    Slawski,

    good question. Next version will provide more in depth logging and your(our) need should be addressed.

    I have seen invalid traffic logging in an asymmetric routing issue on a customer site.

  • 0 in reply to lferrara

    I don't think this is the case. I'm observing those log entries with TCP RESET or FIN flags. I suspect that some applications used in home environment are too carelessly written. I've checked default session timeout and it is quite big - 3 hours, so this shouldn't be a problem, right ?