Which sources repeat?
Repeated sources can indicate retries, scanning, a broken application, or normal high-volume clients. Compare the time window and expected service before assigning motive.
Firewall Log Analyzer
Paste a bounded sample of firewall events. The browser extracts common key-value fields, separates allowed and denied traffic, and surfaces repeated sources, destinations, and services without uploading the logs.
Pasted logs remain in browser memory. Remove tokens, usernames, hostnames, and unrelated personal data before analysis.
Summarize a bounded event sample
Common key-value forms such as src, dst, spt, dpt, proto, action, disposition, and transport are recognized. Lines that cannot be interpreted remain visible in the result.
Best input: one event per line from one control and one investigation window.
Start with what the control actually recorded
An allow event shows that the logging control observed and permitted a match. A deny or drop event shows its recorded decision. Neither establishes the complete path, application identity, user intent, successful authentication, or what another control did.
Which destination services dominate?
Destination ports help group events, but the live process may not match the registered service name. Confirm listeners and ownership on the destination.
What failed to parse?
Unparsed lines are not harmless lines. They show that the sample uses another field format or lacks the values required for this summary.
Preserve context before escalating a finding
Keep the device, software version, timezone, policy identifier, interface, direction, and collection window with the original events. This tool does not alter the sample, but a pasted excerpt may omit the event immediately before or after the activity that explains it.
Build a reviewable evidence handoff
| Field | Why it matters | Common mistake |
|---|---|---|
| Device, interface, and direction | Places the decision at one control and one traffic boundary | Assuming the event describes the complete end-to-end path |
| Timezone and collection window | Connects related endpoint, identity, and application events | Comparing local and UTC timestamps without conversion |
| Rule or policy identifier | Shows which configured decision recorded the match | Creating a new rule before checking the existing one |
| Original source value | Preserves what the device actually emitted | Replacing integer or hexadecimal addresses without retaining the source |
If an export represents an address as an integer, hexadecimal value, or binary string, normalize it with the IPv4 address converter and keep the original field beside the result.
- Save the unmodified event sample with its collection method.
- Connect related records only after reconciling their timezones.
- Compare the finding with the listener, route, rule counters, and application logs.
- Escalate based on confirmed behavior and business context, not frequency alone.
Move from a pattern to a controlled test
Use the port reference to research a destination service clue, then follow the firewall troubleshooting sequence or controlled testing method. Do not create a block rule from frequency alone.
Log field names vary by product. NIST discusses firewall logging and policy management in SP 800-41 Rev. 1. Current vendor documentation remains authoritative for the actual event schema.