How to use Packet Filter option for live logs IP adress

Hi Nick KEY  If you are referring XG Live Log Viewer filter then the below option will help to add a filter as per your requirements. If below not the one which you are referring in your query then please share more info with snapshot where you are trying to search above details.

I want to know which port from my machine is blocked by UTM 9

you'll be identify only the packets dropped and accepted ! so see if the destination port/ip packets are accepted or dropped ?

Yes I want to know which ports is dropped from 172.10.10.1 to 20.20.100.12

I put on the filtering following

srcip="172.10.10.1"  and try to connect

It show me now

 UDP 172.10.10.1:500--->20.20.100.12:500

TCP 172.10.10.1:49688--->20.20.100.12:6501

UDP 172.10.10.1:49689--->20.20.100.12:6502

TCP 172.10.10.1:49690--->20.20.100.12:6502

What should I now define as services???

In that case I'd suggest, open a putty session > login with the root
under the cd /var/log directory and execute the following cmd:
#cat /var/log/packetfilter.log | grep <srcip=x.x.x.x> | grep <dstip=xxxx>

I put on the filtering following

srcip="172.10.10.1"  and try to connect

It show me now

 UDP 172.10.10.1:500--->20.20.100.12:500

TCP 172.10.10.1:49688--->20.20.100.12:6501

UDP 172.10.10.1:49689--->20.20.100.12:6502

TCP 172.10.10.1:49690--->20.20.100.12:6502

What should I now define as services???

Alright so in the following example:

 TCP 172.10.10.1:500--->20.20.100.12:500

this is your srcip - 172.10.10.1 | srcport - 49688 | dstip - 20.20.100.12 | dstport - 6501
services are 49688 & 6501
now try to filter out the service/ip you are looking for !

can I create a service from 48000:49999? Or what is the best praxis?

What is with 6501 and 6502 and 500?

can I create a service from 48000:49999? 
Yes, you can > under the Definitions & users > Service definitions 
UDP Port 500 service is used for IPsec
TCP Port 6501/6502 are used for endpoint communication.
https://www.auditmypc.com/tcp-port-6501.asp
https://www.auditmypc.com/tcp-port-6502.asp

should I not create services for ports 6501/6502 and 500???? But it seems it is dropped

if the packets are dropped, then no need to create it !
by default any service which is not explicitly allowed in the firewall rules, will be dropped Nick KEY 

I will try it without the service definition for  ports 6501/6502 and 500, if I have still issue with that ports, can I create it?

I will try it without the service definition for  ports 6501/6502 and 500, if I have still issue with that ports, can I create it?

Yes you can !

I will try it without the service definition for  ports 6501/6502 and 500, if I have still issue with that ports, can I create it? Yes Or NOT? What do you mean?