Understanding Kiwi syslog messages relating to PIX

[reggiejack]

Hi everyone, we have a ciso Pix 525 firewall in our enviornment. I have recenlty been given permission to at least monitor activities occuring through our pix. I was trying to understand the messages received in the log file. mainly could only determing source and destination address. Is there any good PDF or sites dealing with understanding what is happening with the PIX. I want to be able in the future to look at the syslog like I am reading the newspaper. To have some understanding and be able to interprete what I am seeing. Be able to determine if there is a virus hitting my ports or is someone scanning my ports. that type of stuff. Thanks. Any good tutorial sites as well? Thanks

 

[chicocouk]

I think you'll probably find this pdf useful. You'll know some of it already, but the links off it especially should help you head in the right direction

http://www.sans.org/rr/papers/index.php?id=199

CCNA, MCSE, Cisco Firewall specialist, VPN specialist, wannabe CCSP