Administrator's Guide - Kerio Software Archive

Logs
Example:
[02/Mar/2010 08:54:38] IPS: Packet drop, severity: High,
Rule ID: 1:2008575 ET TROJAN ASProtect/ASPack Packed Binary
proto:TCP, ip/port:95.211.98.71:80(hosted-by.example.com)
-> 192.168.48.131:49960(wsmith-pc.company.com,user:smith)
• IPS: Packet drop — the particular intrusion had the action set for Log
and drop (in case of the Log action, IPS: Alert is displayed in the log)
• severity: High — severity level
• Rule ID: 1:2008575 — number identifier of the intrusion (this number
can be used for definition of exceptions from the intrusion detection
system, i.e. in the system’s advanced settings)
• ET TROJAN ASProtect/ASPack... — intrusion name and description
(only available for some intrusions)
• proto:TCP — traffic protocol used
• ip/port:95.211.98.71:80(hosted-by.example.com) — source IP
address and port of the detected packet; the brackets provide information
of the DNS name of the particular computer, in case that it is identifiable
• -> 192.168.48.131:49960(wsmith-pc.company.com,user:wsmith)
— source IP address and port in the detected packet; the brackets provide
DNS name of the particular host (if identifiable) or name of the user
connected from the particular local host
2. Anti-spoofing log records
Messages about packets that where captured by the Anti-spoofing module (packets with
invalid source IP address) — see section 8.3 for details.
302