RE: Log checking?

["Marcus J. Ranum" <mjr () ranum com>]

Ben Nagy wrote:
> I think there is some mileage to be had in logging the volume of denied
> outbound traffic over time. 

Anyone who has not ALREADY been doing that for years is in
serious need of cranial examination!!

I can only refer you to:
The song of the ancient firewall practitioners, verse 4:
        If your firewall implements your policy,
        and you don't want your future to get dicy,
        examine your deny logs in detail,
        because the contents can be quite spicy!

Seriously, though...  If the firewall implements policy, and your
policy is your enterprise's security plan, then anyone who thinks
that attempted policy violations aren't interesting is in serious
need of clue.

mjr. 

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards