?
Solved

Firewall Log (asa5510) "Hit-Count" Parse

Posted on 2014-02-12
4
Medium Priority
?
610 Views
Last Modified: 2014-02-13
Afternoon Experts,
I'm trying to figure out how to parse a hit count log from my firewall.  This log is a simple hit count dumped from my ASA, but I'm running into trouble parsing the exact info needed.

I'm looking to simply compile a list of incoming IP addresses and then prioritize somehow  by the number of hits.  I thought using MS Excel would be the easiest to group the IP address hits, but I'll use anything free to get the job done.

This log is just a simple dump of  who has been abusing our external IP, and then they are added to a simple black-list.

2014-02-12 14:58:20	Local4.Info	192.168.0.1	Feb 12 2014 14:03:54: %ASA-6-106100: access-list outside_in permitted tcp outside/##.95.44.157(24802) -> inside/###.###.###.###(3389) hit-cnt 8 300-second interval [0x8fe88aaf, 0x0]

Open in new window



My trouble is the inbound IP address isn't a fixed entry.  Which is where my limited experience ends.
0
Comment
Question by:irishmic33
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 23

Accepted Solution

by:
Danny Child earned 2000 total points
ID: 39854812
OK, some assumptions:
the IP you're looking for in the example is ##.95.44.157
it's always preceded by the / character, and followed by the ( character.

If so, and the text string is in A1, put this in A2, and it should pull it out for you:

=MID(A1,FIND("/",A1)+1,FIND("(",A1)-FIND("/",A1)-1)
Basically, it uses 2 FIND queries to locate the characters above, and then feeds them into a MID formula to extract the text itself

I'm guessing I'm on the right track, not a Cisco log specialist I'm afraid!
If this is right, I'd copy the results to a separate sheet, use a Filter for Unique records, and then a COUNTIF to find the biggest hitters.
0
 
LVL 2

Author Comment

by:irishmic33
ID: 39854852
Nice work,
I didn't think of Mid...  I was trying to figure out different ways with Left and Right.

I'll give it a ride once I'm back in the office.
0
 
LVL 2

Author Comment

by:irishmic33
ID: 39856702
OK, some assumptions:
the IP you're looking for in the example is ##.95.44.157
it's always preceded by the / character, and followed by the ( character.

If so, and the text string is in A1, put this in A2, and it should pull it out for you:

=MID(A1,FIND("/",A1)+1,FIND("(",A1)-FIND("/",A1)-1)
Basically, it uses 2 FIND queries to locate the characters above, and then feeds them into a MID formula to extract the text itself

I'm guessing I'm on the right track, not a Cisco log specialist I'm afraid!
If this is right, I'd copy the results to a separate sheet, use a Filter for Unique records, and then a COUNTIF to find the biggest hitters.

This is exactly what was needed.

So... just to sum it up into steps for others:

Step 1:  Copy text into Excel
Step 2:  Use the formula "=MID(A1,FIND("/",A1)+1,FIND("(",A1)-FIND("/",A1)-1)"
Step 3:  Copy the column and paste values into new sheet.
Step 4:  Advance filter the new column with "Unique Only" and "Copy To" new cell.
Step 5:  Then use the CountIf function and identify range, referencing the new filtered list.

Bam!  Exactly what I needed.   You've helped me save so much time.

Thanks as always!
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 39857558
yep, you've nailed it.
cheers for the feedback
Danny
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Access developers frequently have requirements to interact with Excel (import from or output to) in their applications.  You might be able to accomplish this with the TransferSpreadsheet and OutputTo methods, but in this series of articles I will di…
In Part II of this series, I will discuss how to identify all open instances of Excel and enumerate the workbooks, spreadsheets, and named ranges within each of those instances.
The viewer will learn how to use a discrete random variable to simulate the return on an investment over a period of years, create a Monte Carlo simulation using the discrete random variable, and create a graph to represent the possible returns over…
This Micro Tutorial will demonstrate in Microsoft Excel how to add style and sexy appeal to horizontal bar charts.

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question