Security Logs in Kerio Control

[02/Mar/2013 08:54:38] IPS: Packet drop, severity: High, Rule ID: 1:2010575 ET TROJAN ASProtect/ASPack Packed Binaryproto:TCP, ip/port:95.211.98.71:80(hosted-by.example.com) > 192.168.48.131:49960(wsmith-pc.company.com,user:wsmith)

The particular intrusion had the action set for Log and drop (in case of the Log action, IPS: Alert).

Severity level.

Number identifier of the intrusion (this number can be used for the definition of exceptions from the intrusion detection system, i.e. in the system's advanced settings).

Intrusion name and description (only available for some intrusions).

Traffic protocol.

Source IP address and port of the detected packet; the brackets provide information of the DNS name of the particular computer, in case that it is identifiable.

Destination IP address and port in the detected packet; the brackets provide the DNS name of the particular host (if identifiable) or the name of the user connected to the firewall from the particular local host.

[17/Jul/2013 11:46:38] Anti-Spoofing: Packet from LAN, proto:TCP, len:48, ip/port:61.173.81.166:1864 > 195.39.55.10:445, flags: SYN, seq:3819654104 ack:0, win:16384, tcplen:0

Packet direction (eitherfrom, i.e. sent via the interface, or to, i.e. received via the interface).

Name of the interface on which the traffic was detected.

Transport protocol (TCP, UDP, etc.).

Packet size in bytes (including the headers) in bytes.

Source IP address, source port, destination IP address and destination port.

TCP flags.

The sequence number of the packet (TCP only).

Acknowledgment sequence number (TCP only).

Size of the receive window in bytes (it is used for data flow control TCP only).

TCP payload size (i.e. size of the data part of the packet) in bytes (TCP only).

Attack attempt detected — a foreign IP address in the PORT command

Suspicious server reply with a foreign IP address

Authentication: Service: Client: IP address: reason

The Kerio Control service to which the client connects.

Refers to "web administration interface".

Refers to "client interface".

Refers to user authentication on the proxy server.

Encapsulates both Kerio VPN and IPsec VPN.

Refers to messages from the Console.

IP address of the computer from which the user attempted to authenticate.

Reason of the authentication failure (nonexistent user/ wrong password).

Start and shutdown of the Kerio Control Engine:

Start and shutdown of the Intrusion Prevention Engine:

Kerio Control uses components (antivirus engine and signatures, Intrusion Prevention signatures and blacklists). Updates of these components are logged in the Security log.