Network Traffic Log

Network Traffic Log

Cyberoam provides extensive logging capabilities for traffic, system, and network protection functions. Detailed log
information and reports provide historical as well as current analysis of network activity to help identify security
issues and reduce network misuse and abuse.
Cyberoam provides following logs:
DoS Attack Log
Invalid Traffic Log
Firewall Rule Log
Local ACL Log
Dropped ICMP Redirected Packet Log
Dropped Source Routed Packet Log
Cyberoam sends Network traffic log to the syslog server. Check your syslog server to view logs.
By default, only the firewall rule logging will be ON i.e. only traffic allowed/denied by the firewall will be logged.
SR.
No.
1.

DATA FIELDS

TYPE

DESCRIPTION

Date

date

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was
started on Cyberoam

2.

Time

time

For the dropped traffic - the date when the packet was dropped
by Cyberoam
Time (hh:mm:ss) when the event occurred
For the allowed traffic - the tome when the connection was
started on Cyberoam

3.
4.
5.

Device Name
Device Id
Log Id

String
String
string

For the dropped traffic - the time when the packet was dropped
by Cyberoam
Model Number of the Cyberoam Appliance
Unique Identifier of the Cyberoam Appliance
Unique 7 characters code (c1c2c3c4c5c6c7) e.g. 0101011,
0102011
c1c2 represents Log Type e.g. 01
c3c4 represents Log Component e.g. Firewall, local ACL
c5c6 represents Log Sub Type e.g. allow, violation

4.

Log Type

string

c7 represents Priority e.g. 1

Section of the system where event occurred e.g. Traffic for
traffic logging.
Possible values:
01 Traffic - Entire traffic intended for Cyberoam

Network Traffic Log

SR.
No.
5.

DATA FIELDS

TYPE

DESCRIPTION

Log Component

string

Component responsible for logging

Possible values:
01 - Firewall rule
Event due to any traffic allowed or dropped based on the
firewall rule created
02 - Local ACL
Event due to any traffic allowed or dropped based on the local
ACL configuration or all other traffic intended for the firewall
03 - DoS Attack
Event due to any packets dropped based on the dos attack
settings i.e. dopped tcp, udp and icmp packets.
04 - Invalid traffic
Event due to any traffic dropped which does not follow the
protocol standards, invalid fragmented traffic and traffic whose
packets Cyberoam is not able to relate to any connection.
Refer to Invalid traffic list for more details.
05 - Invalid Fragmented traffic
Event when any invalid fragmented traffic is dropped. Refer to
Invalid Fragmented traffic list for more details.
06 - ICMP redirect
Event due to any ICMP Redirected packets dropped based on
the DoS attack setting

07 - Source routed packet

Event due to any source routed packets dropped based on the
DoS attack setting

6.

Log Sub Type

string

08 Fragmented traffic
Event when any fragmented traffic is dropped due to Advanced
Firewall settings. Refer to Console Guide Page no. 59 for more
details.
Decision taken on traffic
Possible values:
01 Allowed
Traffic permitted to and through Cyberoam based on the
firewall rule settings

7.
8.

9.
10.
11.

Status
Priority

Duration
Firewall Rule ID
User

string
string

02 Violation
Traffic dropped based on the firewall rule settings, local ACL
settings, DOS settings or due to invalid traffic.
Ultimate state of traffic (accept/deny)
Severity level of traffic

integer
integer
string

Possible values:
01 Notice
Durability of traffic
Firewall rule id of traffic
User Id

Network Traffic Log

SR.
No.
12.
13.
14.

15.

16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.

28.

DATA FIELDS

TYPE

DESCRIPTION

User Group
IAP
In Interface

string
integer
string

Group Id of user
Internet Access policy Id applied for traffic
Interface for incoming traffic e.g. eth0

string

Blank for outgoing traffic

Interface for outgoing traffic e.g. eth1

string
string
integer
integer
integer
integer
integer
integer
integer

Blank for incoming traffic

Source IP address of traffic
Destination IP address of traffic
Protocol number of traffic
Source Port of TCP and UDP traffic
Destination Port of TCP and UDP traffic
ICMP type of ICMP traffic
ICMP code of ICMP traffic
Total number of packets sent
Total number of packets received

Out Interface

Source IP
Destination IP
Protocol
Source Port
Destination Port
ICMP Type
ICMP Code
Sent Packets
Received
Packets
Sent Bytes
Received Bytes
Translated
Source IP

Translated
Source Port

integer
integer
integer

integer

Total number of bytes sent

Total number of bytes received
Translated Source IP address if Cyberoam is deployed as
Gateway
"N/A" - if Cyberoam is deployed as Bridge
Translated Source port if Cyberoam is deployed as Gateway

29.

Translated
Destination IP

integer

"N/A" - if Cyberoam is deployed as Bridge

Translated Destination IP address if Cyberoam is deployed
as Gateway

30.

Translated
Destination Port

integer

"N/A" - if Cyberoam is deployed as Bridge

Translated Destination port if Cyberoam is deployed as
Gateway
"N/A" - if Cyberoam is deployed as Bridge

Invalid traffic
Cyberoam will define following traffic as Invalid traffic:
Short IP Packet
IP Packets with bad IP checksum
IP Packets with invalid header and/or data length
Truncated/malformed IP packet
Packets of Ftp-bounce Attack
Short ICMP packet
ICMP packets with bad ICMP checksum
ICMP packets with wrong ICMP type/code
Short UDP packet
Truncated/malformed UDP packet

Network Traffic Log

UDP Packets with bad UDP checksum
Short TCP packet
Truncated/malformed TCP packet
TCP Packets with bad TCP checksum
TCP Packets with invalid flag combination
Cyberoam TCP connection subsystem not able to relate TCP Packets to any connection
If Strict Internet Access Policy is applied then Cyberoam will define following traffic also as Invalid traffic:
UDP Packets with Destination Port 0
TCP Packets with Source Port and/or Destination Port 0
Land Attack
Winnuke Attack
TCP Syn Packets contains Data
IP Packet with Protocol Number 0
IP Packet with TTL Value 0
Invalid Fragmented traffic
Cyberoam will define following traffic as Invalid Fragmented traffic:
Fragment Queue out of memory while reassembling IP fragments
Fragment Queue Timeout while reassembling IP fragments
Fragment too far ahead while reassembling IP fragments
Oversized IP Packet while reassembling IP fragments
Fragmentation failure while creating fragments

Document version: 9305-1.0-26/03/2007