RE: Firewall Log interpretation

BAlfson — Wed, 12 Apr 2017 11:56:22 GMT

Hi, Sebastiaan, and welcome to the UTM Community!

As Dirk says, the MAC addresses represent the next physical hop to reach an IP - your ISP's router and your internal switch.

Cheers - Bob

RE: Firewall Log interpretation

dirkkotte — Fri, 07 Apr 2017 13:52:26 GMT

That's OK. Thats how IP-routing works.

within LAN (same subnet) you see the MAC for every device.

With routing you see the MAC of the router for all IP's behind this device.

This can be explained with OSI 7 layer model...

https://support.microsoft.com/de-de/help/103884/the-osi-model-s-seven-layers-defined-and-functions-explained

The MAC address within packet are from L2. The L2 don#t know something from L3(IP). Here we see only communication between direct linked devices. (Router<->Firewall or Firewall<->endsystem)