Sophos SG310 -Interpreting Dropped Packets in Firewall Log

Your example above is an advanced threat detection (ATP) (edited)

Robert Hartung said:

name="Packet dropped (ATP)" action="drop" fwrule="63001" initf="eth0" threatname="C2/Generic-A

Here is your list you asked for:  https://lists.astaro.com/ASGV9-IPS-rules.html

I think that is a bit outdated, but you might find the updated list on Snort's site.

A default drop based on AV...?

https://support.sophos.com/support/s/article/KB-000034242?language=en_US

Target ip appears to be poor reputation too.

https://talosintelligence.com/reputation_center/lookup?search=195.133.40.15 .

Yeah I edited a couple of times, I typed anti-virus, and meant Advanced, lol.  Those can be DNS poison attempts (China does that a lot) and other things.

That's quite a list.

I probably didn't ask this question clearly and may have used a bad example to boot.

The Sophos firewall log is pretty much all dropped packets. What I'm looking for is how to interpret the "fwrule" number. I looked at the log for just part of a day and it contained a mere 234,000 entries. I searched through those entries and got this list of unique fwrule number.

• 0
• 34
• 60001
• 60002
• 60003
• 60004
• 60005
• 60006
• 62001
• 62004

When I go into the Sophos firewal rule setup (Network - Protection - Firewall - Rules) I can't find any reference to the fwrule numbers listed above.

For any given firewall dropped packet, I'd like to know what rule dropped the packet.

Did you review the link I provided above?

OK. I guess I missed checking your second link.

Yes, that does give me the info I was looking for. It also showed you can go into user-created firewall rules and turn on logging for them in the Advanced menu.

Thanks for pointing the article out.