What do “blocked”, “denied” and “dropped” mean in a firewall log?¶
title: "What do “blocked”, “denied” and “dropped” mean in a firewall log?" card_id: "IP-101" status: "complete" source_document: "https://docs.google.com/document/d/1nJ0GzJHpsxm2cWpxOwPa2_-nOhcYZ2mKSD0iXsPg_qw/edit?usp=drivesdk"
What do “blocked”, “denied” and “dropped” mean in a firewall log?¶
IP-101 — What does “blocked”, “denied” or “dropped” mean in a firewall log?¶
If a firewall log says traffic was blocked, denied or dropped, it means the firewall prevented or discarded the traffic it recorded at that point.
It doesn’t mean that a connection was completed.
It doesn’t automatically mean that somebody was attacking the system.
And it certainly doesn’t prove that the protected system was compromised.
The exact words vary between firewall products.
One firewall might record an action as “blocked”.
Another might say “denied”.
Another might say “dropped”.
There can be technical differences between those actions, but the main point is that the firewall didn’t allow the recorded traffic to pass.
A firewall record may relate to a single packet rather than a complete connection.
For example, a system on the internet might send the first packet used to try to establish a TCP connection.
If the firewall blocks that packet, the connection can’t be established through that route at that time.
The log shows an attempted communication reaching the firewall and being stopped.
It doesn’t show that the source successfully connected to the destination.
You may also see a distinction between traffic being dropped and traffic being rejected.
If a firewall drops traffic, it normally discards it without sending a response to the source.
From the source system’s point of view, nothing may appear to happen. It may simply wait for a response and eventually time out.
If the firewall rejects the traffic, it normally blocks it but sends a response indicating that the communication wasn’t accepted.
Either way, the firewall has prevented that traffic from passing.
The difference is mainly whether the source receives a response.
Be careful not to treat every blocked entry as evidence of malicious activity.
Systems connected to the internet are constantly exposed to automated traffic.
That includes scanning for open ports, attempts to identify running services and automated requests sent across enormous ranges of IP addresses.
Some of it is malicious.
Some of it is security research.
Some of it comes from badly configured systems.
And some of it is simply unwanted background noise.
A large number of blocked attempts might therefore show automated scanning rather than a person deliberately targeting that particular organisation.
The pattern, timing, destination ports and any related activity may help establish what was happening, but the word “blocked” doesn’t answer that question by itself.
A blocked firewall entry also isn’t evidence that the protected system was compromised.
In many cases, it shows the opposite: the firewall received traffic that wasn’t permitted and the control worked as intended.
That doesn’t prove the whole network was safe.
The same source might have tried another route.
Other traffic might have been allowed.
And activity could have taken place before or after the recorded event.
But those are separate questions requiring separate evidence.
If all you have is the firewall entry, an accurate description might be:
“The firewall recorded and blocked traffic from this source address towards this destination address and port.”
That is different from saying:
“The source successfully connected to the destination.”
And it is very different from saying:
“The source compromised the system.”
Blocked, denied or dropped means the firewall stopped the traffic it recorded at that point.
Who generated it, why it was sent and whether anything else succeeded all require further evidence.