Log packet formatting

Log packet formatting in the debug and filter logs allows further customization of the output to make the logs easier for you to read. This article explains these customization options and how to use them.

1. In the administration interface, go to Logs > Debug/Filter.
2. In the context menu, click Format of logged packets.
3. Type an expression.
4. Click OK.

Creating expressions

Format of logged packets is defined by special expressions (a template). You can edit this template to get transparent and relevant information.

Default template

The default template for packet logging follows this pattern:

%DIRECTION%, %IF%, proto:%PROTO%, len:%PKTLEN%,
		 %SRC% - %DST%, %PAYLOAD%

Expressions introduced with % are variables. Other characters and symbols represent static text as printed in the log.

Variables

The following variables can be used in packet logging templates:

• %DIRECTION% — traffic direction in respect of the particular network interface of the firewall (incoming / outgoing)
• %IF% — interface name
• %PROTO% — protocol type (TCPTransmission Control Protocol - ensures packet transmission., UDPUser Datagram Protocol - ensures packet transmission., etc.)
• %PKTLEN% — packet size
• %SRC% — source IP addressAn identifier assigned to devices connected to a TCP/IP network. and port (depending on the protocol attribute Raw)
• %DST% — destination IP address and port (depending on the protocol attribute Raw)
• %SRCMAC% — source MAC addressMedia Access Control Address - A unique identifier that specifies a device in a network.
• %DSTMAC%— destination MAC address
• %PAYLOAD% — size of the data part of the packet with details provided (depending on the protocol and attributeRaw)
• %PAYLOADLEN% — size of the data part of the packet
• %DSCP% — DSCP value in the IP header

If you wanted to track the direction on an interface, the source and destination and size of the packet:

%DIRECTION% %IF%, %SRC% >> %DST%, length %PKTLEN%

Which would result in the following:

[08/Sep/2012 11:47:39] PERMIT "Firewall traffic" packet from WANWide area network - A network that connects computers and other devices in a large area., 192.168.52.2:53 >> 192.168.52.128:1035, length 96
[08/Sep/2012 11:47:39] PERMIT "Firewall traffic" packet to WAN, 192.168.52.128:1035 >> 192.168.52.2:53, length 63

If you wanted to also show the protocol that was being used the following would display this:

%DIRECTION% %IF% %PROTO% (%SRC% >> %DST%)

Which would result in the following:

[08/Sep/2012 16:12:33] PERMIT "Firewall traffic" packet to WAN UDP (192.168.52.128:1121 >> 192.168.52.2:53)
[08/Sep/2012 16:12:33] PERMIT "Firewall traffic" packet from WAN UDP (192.168.52.2:53 >> 192.168.52.128:1121)