Hi all,

I have a log file here form my router. I believe it's like iptables or some form of stateful firewall. Would love some help in breaking down the data below. What does it all mean.


Dec 01 17:36:06
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55600 PROTO=TCP SPT=56223 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:56
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55589 PROTO=TCP SPT=56222 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:46
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55578 PROTO=TCP SPT=56221 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:36
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55566 PROTO=TCP SPT=60797 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:26
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55555 PROTO=TCP SPT=60796 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:16
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55544 PROTO=TCP SPT=60795 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:35:06
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55533 PROTO=TCP SPT=60794 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4
Dec 01 17:34:56
Allowed CONN=lan SRC=192.168.1.107 DST=52.69.98.219 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=55522 PROTO=TCP SPT=60793 DPT=8080 WINDOW=2048 RES=0x00 SYN URGP=0 MARK=0x4

Last line:
Allowed - Pretty obvious. Connection was allowed.
CONN=lan - Name of the network where connection was recorded.
SRC=192.168.1.107 - Source IP address.
DST=52.69.98.219 - Destination IP address.
LEN=48 - Amount of data transferred in this packet.
TOS=0x00 - Type of service.
PREC=0x00
TTL=63 - Time to live. Max amount of time this connection would be attempted before timeout.
ID=55522 - Internal ID for the firewall.
PROTO=TCP - Protocol. (TCP/UDP/ICMP etc.)
SPT=60793 - Source port. (Usually random port used to establish connection.)
DPT=8080 - Destination port (Usually defined by protocol)
WINDOW=2048 - TCP window size.
RES=0x00
SYN - Existing connection.
URGP=0
MARK=0x4 - Marked by a firewall rule.

This looks like an outgoing connection to a web server (aka you opening a web page.)
I missed a few that I don't remember of the top of my head :-)

This looks very much like the output of the -j LOG target in iptables. Each line is the description of a packet. You would get similar information from the tcpdump command.

If you want to know the TCP header fields https://en.wikipedia.org/wiki/Transm...ment_structure

Outstanding guys. Thanks for the quick comeback, especially the link https://en.wikipedia.org/wiki/Transm...ment_structure

Good stuff, some reading to do, have a great day.