PIX/ASA Connection Duration Logging and Reporting

Unanswered Question
May 29th, 2009

I need to review and analyze connections which are maintained over a certain time period. I cannot get this in a legible format from the PIX/ASA directly during the activity with scalability, so the best I think I can do is look at it after the fact.

So what I have are the teardown messages from the PIX/ASA products in our MARS appliance.

Messages which have this info are like these 302016 and 302014.

May 29 2009 10:43:37: %PIX-6-302014: Teardown TCP connection 543470 for outside:1.2.3.4/3136 to inside:7.8.9.10/80 duration 0:02:04 bytes 1121 TCP FINs

May 29 2009 10:43:33: %PIX-6-302016: Teardown UDP connection 543463 for outside:1.2.3.4/1079 to inside:7.8.9.10/80 duration 0:02:01 bytes 454

Note: Addresses and/or ports listed above may have been changed.

Sometimes we have TCP and UDP connections which last for days. I have no real good way to report on the lengthy ones. Yet.

Can MARS analyze the PIX/ASA 302016 and 302014 messages for values after the “duration” string which may be greater than say 10 hours and create an event, another event for durations greater than say 5 days? Can some be created into low incidents?

If so, can you give me the keywords necessary to look this up in the MARS manuals myself? Also, I am not a coder/scripter and if good regex ability is needed, if you know of a good self help tutorial on the web you can refer me to, that would be good as well.

Thanks.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
bnidacoc Fri, 06/05/2009 - 04:36

? I'm not wondering why these messages are occurring.

I'm not seeking to break connections, I'm seeking a report of connections which meet a certain criteria.

I'm wanting to know which ones have a duration value greater than certain amounts, like 10 hours for example.

Actions

This Discussion