Sophos XG Firewall | Appendix A - Logs | 535
Data Fields
protocol src_port dst_port bytes_sent bytes_received quarantine_reason
Type
integer integer integer integer integer string
Description
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and UDP traffic
Total number of bytes sent
Total number of bytes received
Reason for the quarantine mail
Firewall Logs
Message ID
01601
02001
02002
03001
04001
05001
05051
05101
00001
00002
00003
00004
00005
00007
01001
01301
05151
05201
05301
05401
010202100
010202101
010202102
010202103
010202104
010202105
Message
Firewall traffic allowed
Firewall traffic denied
Firewall traffic dropped by Galileo Heartbeat
ICMP-related packets denied
ICMP-related packets allowed
Allowed missing heartbeat traffic in case of no restriction
Invalid traffic dropped
Fragmented traffic denied
Invalid fragmented traffic denied
Local ACL traffic allowed
Local ACL traffic denied
DoS attack dropped
ICMP-redirected packet dropped
Source-routed packet dropped
Foreign host denied
IPMAC pair denied
IP Spoof denied
SSL VPN resource access denied
ARP Flood traffic denied
Traffic for virtual host <virtualhostname> is denied. No
Internal server is available to process the traffic.
Invalid packet.
IP packet with invalid header.
IP packet with invalid header version.
IP packet with invalid header time-to-live.
IP packet with invalid header protocol.
Truncated/malformed IP packet.
Message ID
010202122
010202123
010202124
010202125
010202126
010202127
010202128
010202129
010202130
010202131
010202132
010202133
010202134
010202135
010202136
010202137
010202138
010202139
010202140
010202141
010202106
010202107
010202108
010202109
010202110
010202111
010202112
010202113
010202114
010202115
010202116
010202117
010202118
010202119
010202120
010202121
Message
Bad IP checksum.
IP packet with invalid address(es).
Invalid IP fragment.
Short ICMP packet.
Bad ICMP checksum.
ICMP packets with invalid ICMP type/code.
Invalid packet, no ICMP record found.
ICMP packet error.
Short UDP packet.
Truncated/malformed UDP packet.
Bad UDP checksum.
Invalid UDP destination.
Short TCP packet.
Truncated/malformed TCP packet.
Bad TCP checksum.
TCP packets with invalid flag combination.
Invalid TCP state.
Invalid TCP RST.
Invalid TCP source port.
Invalid TCP destination port.
TCP land attack.
Invalid TCP reserved bit.
TCP winnuke attack.
Could not associate packet with any connection.
FTP-bounce attack.
Short UDPlite packet.
Bad UDPlite checksum.
UDPlite checksum is missing.
Invalid DCCP packet.
Invalid DCCP state.
Short DCCP packet.
Truncated/malformed DCCP packet.
Bad DCCP checksum.
Invalid DCCP reserved packet.
Invalid connection helper.
Packet discarded.
Sophos XG Firewall | Appendix A - Logs | 536
Sophos XG Firewall | Appendix A - Logs | 537
Module-specific Fields
Data Fields
status con_duration fw_rule_id user user_group web_policy_id ips_policy_id appfilter_policy_id app_name app_risk
Type
string integer integer string string integer integer
Integer string integer app_technology app_category in_interface out_interface src_ip src_mac src_country dst_ip dst_country protocol src_port dst_port icmp_type icmp_code string string string string string string string string string integer integer integer integer integer
Description
Ultimate status of traffic – Allowed or Denied
Duration of connection (in seconds)
Firewall Rule ID which is applied on the traffic
User name
Group name to which the user belongs
Internet Access policy ID applied on the traffic
IPS policy ID applied on the traffic
Application Filter policy applied on the traffic
Application name
Risk level assigned to the application
Possible values:
1 - VERY LOW
2 - LOW
3 - MEDIUM
4 - HIGH
5 - VERY HIGH
Technology of the application
Possible values:
Browser Based
Client Server
Network Protocol
P2P
Name of the category under which application falls
Interface for incoming traffic, e.g., Port A
Interface for outgoing traffic, e.g., Port B
Original source IP address of traffic
Original source MAC address of traffic
Code of the country to which the source IP belongs
Original destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original source port of TCP and UDP traffic
Original destination port of TCP and UDP traffic
ICMP type of ICMP traffic
ICMP code of ICMP traffic
Data Fields
packets_sent packets_received bytes_sent bytes_received src_trans_ip src_trans_port dst_trans_ip dst_trans_port src_zone_type src_zone dst_zone_type dst_zone con_direction con_event con_id virt_con_id hb_status
Type
integer integer integer integer integer integer integer integer string string string string string integer integer string
Sophos XG Firewall | Appendix A - Logs | 538
Description
Total number of packets sent
Total number of packets received
Total number of bytes sent
Total number of bytes received
Translated source IP address for outgoing traffic. It is applicable only in route mode.
Possible values
"" - When appliance is deployed in Bridge mode or source IP translation is not done.
IP Address - IP address with which the original source IP is translated.
Translated source port for outgoing traffic. It is applicable only in route mode.
Possible values
"" - When appliance is deployed in Bridge mode or source port translation is not done.
Port - Port with which the original port is translated.
Translated destination IP address for outgoing traffic. It is applicable only in route mode.
Possible values
"" - When appliance is deployed in Bridge mode or destination IP translation is not done.
IP Address - IP address with which the original destination IP is translated.
Translated destination port for outgoing traffic. It is applicable only in route mode.
Possible values
"N/A" - When appliance is deployed in Bridge mode or destination port translation is not done.
Port - Port with which the original port is translated.
Type of source zone, e.g., LAN
Name of source zone
Type of destination zone, e.g., WAN
Name of destination zone
Packet direction. Possible values:“org”, “reply”, “”
Event on which this log is generated
Unique identifier of connection
Connection ID of the master connection
Status of heartbeat traffic
