What does “allowed” mean in a firewall log?¶
title: "What does “allowed” mean in a firewall log?" card_id: "IP-100" status: "complete" source_document: "https://docs.google.com/document/d/1TZPU8qkg2iZ-KaknZlJ_87UT-KhfLlEJ1XR2OBtMzp8/edit?usp=drivesdk"
What does “allowed” mean in a firewall log?¶
What does “allowed” mean in a firewall log?¶
What does it mean when a firewall log says traffic was allowed?
At its most basic, it means the firewall applied its rules and didn't block the traffic recorded in that entry.
That’s all you can safely say without looking at the rest of the record.
Allowed doesn't automatically mean that a connection was successfully established.
It doesn't mean that somebody logged into an account.
It doesn't mean that a webpage loaded.
And it doesn't prove that any data was successfully uploaded or downloaded.
The firewall only records what it observed from its position in the network.
Imagine a device sending traffic towards a server.
The firewall checks that traffic against its rules.
If the traffic is permitted to pass, the firewall may record the action as:
Allowed.
Accepted.
Passed.
Permitted.
Or something similar.
But the traffic still has further to go.
It could be blocked by another firewall.
It could fail somewhere else on the network.
The destination server might not be running.
The relevant port might not be accepting connections.
Or the application might receive the connection and reject whatever was requested.
So an allowed firewall entry tells you that the traffic passed that particular control.
It doesn't tell you the final outcome.
You also need to establish what type of record you’re looking at.
Some firewalls record individual packets.
Some record the beginning of a connection.
Others create a session record and update it when the connection ends.
Those records have different evidential value.
A single allowed packet may only show that one piece of traffic was permitted to pass.
A session record showing traffic in both directions, a connection duration and data transferred may provide stronger evidence that communication took place.
But it still doesn't tell you what the user actually did unless the firewall or another system recorded that information.
The protocol also matters.
With TCP traffic, the first packet may be part of an attempt to establish a connection.
Allowing that packet through doesn't prove that the full connection was completed.
UDP doesn't use the same connection process, so a firewall may describe UDP traffic as a session even though there was no formal connection to establish.
This is why the word “allowed” has to be interpreted alongside the rest of the record.
Look at:
What event the firewall recorded.
Whether there was traffic in both directions.
Whether a session duration is shown.
Whether any bytes were transferred.
And whether another system recorded what happened next.
Be careful with the language you use.
If all you have is the firewall entry, an accurate description might be:
“The firewall recorded and allowed TCP traffic from this source address towards this destination address and port.”
That is different from saying:
“The source device successfully connected to the server.”
And it is very different from saying:
“The user accessed the service.”
Other records may allow you to reach those conclusions.
But the word “allowed” doesn't get you there by itself.
It also doesn't tell you whether the traffic was legitimate or malicious.
A firewall can allow harmful traffic because it matches an existing rule.
It can also allow completely ordinary traffic generated automatically by an application or background service.
For now, remember:
Allowed means the firewall didn't stop the traffic it recorded.
What happened before that point, what happened afterwards and who was responsible all require further evidence.