RE: RE: Router Internet Monitoring

On the pix you can suppress different types of messages to you won't see
them in the log. You do it by the specific message number at the beginning
of the log message. I have down it for one or two messages but I would
think much more than that would be to administrative. It could also defeat
the whole purpose of logging because you suppress the messages for
everything not just per interface (I am pretty sure).

-----Original Message-----
From: firewall-wizards-admin_at_honor.icsalabs.com
[mailto:firewall-wizards-admin_at_honor.icsalabs.com] On Behalf Of George Peek
Sent: Thursday, September 04, 2003 12:22 PM
To: 'rogue'; George Peek
Cc: 'security-basics_at_securityfocus.com'; 'owen_at_delong.com';
'firewall-wizards_at_honor.icsalabs.com'
Subject: [fw-wiz] RE: Router Internet Monitoring

Problem with Pix is it is logging literally everything, hence we have
multiple DMZs.. for frame, dial-up, internet, internal, etc. I have not
fully explored filtering, we use Kiwi Syslog Daemon for logging but the file
grows extremely huge. In the future, SQL solution (which it supports) will
be implemented but for now I need something live to monitor.

Can you use the Cisco Pix Device Manager to filter the log?

-----Original Message-----
From: rogue [mailto:rogue_at_nocdemon.net]
Sent: Thursday, September 04, 2003 9:29 AM
To: George Peek
Cc: 'security-basics_at_securityfocus.com'; 'owen_at_delong.com';
'firewall-wizards_at_honor.icsalabs.com'
Subject: Re: Router Internet Monitoring

if you tell your PIX to log to a syslog server and ramp up the PIX logging
to informational youll see every URL connection made from withinyour
network.

-rogue

On Wed, 3 Sep 2003, George Peek wrote:

> This may be a bit offtopic, if so please excuse me. I am looking for a
> solution to monitor the live traffic (i.e. incoming/outgoing traffic,
incl.
> able to determine what url the user is going to) on our Cisco 2620.
Freeware
> would be great, linux solution is ok. I don't want to use a network
capture
> utility such as sniffer, fluke or iris. Pix has the device manager
> which comes in handy. I can enable logging via SNMP, but it is text
> based, a GUI utility that will sort that information would be very
> cool.
>
> Thank You,
> George Peek
>
>
---------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Federal, September 29-30
> (Training), October 1-2 (Briefings) in Tysons Corner, VA; the world's
> premier technical IT security event. Modeled after the famous Black
> Hat event in Las Vegas! 6 tracks, 12 training sessions, top speakers
> and sponsors. Symantec is the Diamond sponsor. Early-bird
> registration ends September
6.Visit us: www.blackhat.com
>
----------------------------------------------------------------------------
>

-- 
==================
rogue_at_nocdemon.net
       	     {\o0|
================== _______________________________________________
firewall-wizards mailing list firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards