Security

Ask something
Discussion Locked

Router Logs

0 helpful
3 replies

by rz.men

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Currently, we have been charged with auditing/reviewing the Router logs for our network. I was given READ access to them, and I can browse the logs. However, I do not know what I am looking for as far as 'malicious' activity. Can some one pls advise what is important to check in these router logs. (We have Cisco routers) Thanx. /RayM.

3 replies

by difster

There are lots of things to look at and you may not be able to find anything useful.

No doubt you'll find massive chunks of port scans from script kiddies. That's not necessarily malicious but it is annoying and it can detract from any real intrusion attempts.

The toughest attacks to find are those that the attacker does slowly. They will send small probes every day or every couple of days.

There are a number of log analyzers out there (look on securityfocus.com) that might do a better job of parsing your logs than your own eye.

The other tough thing about analyzing logs is that you need to have a baseline of what normal traffic for you looks like.

Best of luck to you.

by ms

If you`re using syslog the best practice is to use log analyser (commercial -> webtrends) or use linux (there is plenty of log analysers for linux platform), if you collect it with syslog it`s quite easy but if you got more than 5 routers to maintain you should develop some IDS sollution (try www.snort.org) - its cool and free

by jluster

"best practice" is quite a harsh word considering we're dealing with security here. Security usually does not involve the use of one closed source program to audit another. snort is a good start but not very useful when auditing router logs.

Here's my take on this:

get a system to log to. A good start would be a standard FreeBSD machine, clean slate, minial install. Install Perl and swatch to parse the incoming logs. Also do a nightly grep over the logs to find accesses to the management ports, snmp queries and the usual suspects such as CodeRed/Nimda accesses, etc.

To get a real time update on those events, I'd recommend netflow and a threshold based warning mechanism.

This discussion is closed to new replies.