Skip to main content
Jan_Scholten
Jan_Scholten
New Member
April 18, 2013
Solved

Top Source/Destination by service

  • April 18, 2013
  • 2 replies
  • 5228 views
I' m trying to get rid of any any allow rules (yes there are some). So i thought about using the FA for this, but i am missing an option for Top Source destination by service (by Volume or Sessions) But i only find Top Services by Volume Top Source Desination Pairs by volume Top Desination Source Pairs by volume Top Service by Volume for most Common Sources Top Service by Volume for most Common Destinations Ideally i' d like to get the currently most used " conversations" between source&dest and the used protocol to gather whether create a allow or deny policy. Any hints on how to achive that with FAZ? FGT is a HA Cluster of 110C running 4.2.7 FAZ is a 1000C running 4.2.5
    Best answer by AtiT
    Hi Jan Scholten! Is it something like this you are looking for? allowed-source-destination-service by bandwidth SELECT `srcip`, `dstip`, `service`, SUM(COALESCE(`sentbyte`,0)+COALESCE(`rcvdbyte`,0)) AS bandwidth FROM $log WHERE `status`=' accept' GROUP BY `srcip`, `dstip`, `service` ORDER BY bandwidth DESC For blocked traffic is better to check the sessions to see what is mostly denied: denied-source-destination-service by session SELECT `srcip`, `dstip`, `service`, COUNT(*) AS totalnum FROM $log WHERE `status`=' deny' GROUP BY `srcip`, `dstip`, `service` ORDER BY totalnum DESC All dataset for traffic logtype. Dataset for version 5.0.2 but it will be the same for older versions - check the fields. Regards,

    2 replies

    emnoc
    emnoc
    New Member
    April 18, 2013
    No but the following would do this with ease; http://www.plixer.com/Scrutinizer-Netflow-Sflow/ and Sflowd
    AtiT
    AtiTAnswer
    New Member
    May 12, 2013
    Hi Jan Scholten! Is it something like this you are looking for? allowed-source-destination-service by bandwidth SELECT `srcip`, `dstip`, `service`, SUM(COALESCE(`sentbyte`,0)+COALESCE(`rcvdbyte`,0)) AS bandwidth FROM $log WHERE `status`=' accept' GROUP BY `srcip`, `dstip`, `service` ORDER BY bandwidth DESC For blocked traffic is better to check the sessions to see what is mostly denied: denied-source-destination-service by session SELECT `srcip`, `dstip`, `service`, COUNT(*) AS totalnum FROM $log WHERE `status`=' deny' GROUP BY `srcip`, `dstip`, `service` ORDER BY totalnum DESC All dataset for traffic logtype. Dataset for version 5.0.2 but it will be the same for older versions - check the fields. Regards,
    Terms & ConditionsAccessibility statement