What is a firewall log?¶

A firewall log records how a firewall handled network traffic according to its configured rules.

It may show that a connection was allowed, blocked, rejected, dropped or inspected between a source and destination.

Avoid this assumption: That a firewall entry proves either that an attack occurred or that the recorded communication successfully reached its final destination. Neither conclusion follows automatically.

A firewall makes decisions at a particular point in a network. Its log may contain source and destination IP addresses, ports, protocol, rule name, action, interface, session information, byte counts and timestamps. This can help establish that traffic reached the firewall and how the firewall responded.

A blocked or dropped entry usually shows an attempted communication that the firewall did not permit through that control point. It does not necessarily show who generated it, why it occurred or whether another route succeeded. An allowed entry shows that the firewall permitted traffic, not that the destination accepted it, that an application completed its task or that data was actually viewed by a person.

Address translation may also change what appears in the log. Internal addresses, public addresses and translated ports may all need to be mapped. Rules can be broad, temporary or misconfigured, and log wording varies between vendors.

Investigators should obtain the rule name or identifier, action definition, firewall location, time zone and relevant NAT information. Ask whether the record relates to session start, session end or an individual packet. Preserve configuration and surrounding events where proportionate.

Correlate important firewall entries with endpoint, server, proxy, VPN, DNS and application logs. Where malicious activity is alleged, determine whether the traffic was merely attempted, permitted, established or followed by a successful application event.

Operational takeaway¶

A firewall log shows how one firewall handled observed traffic, not automatic proof of an attack, a completed connection, data transfer or personal attribution.