Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes for PIX 6-308001 6-605005, and 6-605004 #1124

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fixes for PIX 6-308001 6-605005, and 6-605004 #1124

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
23c3e14
Further corrections and improvements to pix-6-308001 605004 and 605005
crlorentzen May 15, 2017
fd4ba55
Added examples from ASA output
crlorentzen May 15, 2017
4400bd5
Fixed indents
crlorentzen May 15, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions etc/decoder.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1347,8 +1347,11 @@ Jan 8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
- %PIX-6-305012: Teardown dynamic UDP translation from inside:1.1.1.1/12 to outside:1.2.1.2/11 duration 0:00:11.
- %PIX-3-305005: No translation group found for icmp src outside:x.x.x.x dst inside:x.x.x.x (type 3, code 0)
- %ASA-2-106001: Inbound TCP connection denied from 1.2.3.4/1234 to 213.207.99.248/445 flags SYN on interface outside (Message repeated 2 times)
- %PIX-6-605005: Login permitted from 192.168.1.2/2953 to inside:192.168.1.1/telnet for user ""
- %ASA-6-308001: Console enable password incorrect for 3 tries (from ssh (remote 198.18.1.100))
- %PIX-6-605004: Login denied from 192.168.2.10/32597 to outside:192.168.2.14/ssh for user "root"
- %ASA-6-605004: Login denied from 198.18.1.100/56332 to outside:198.18.1.254/ssh for user "*****"
- %ASA-6-605005: Login permitted from 198.18.1.100/47849 to outside:198.18.1.254/ssh for user "us3rn@m3"
- %PIX-6-605005: Login permitted from 192.168.1.2/2953 to inside:192.168.1.1/telnet for user ""
- %PIX-6-305011: Built dynamic UDP translation from inside:192.168.1.2/1026 to outside:192.168.2.14/1163
- %PIX-6-305011: Built dynamic TCP translation from inside:192.168.1.3/54946 to outside:192.168.2.14/1033
- %PIX-6-302015: Built outbound UDP connection 156 for outside:192.168.2.10/1514 (192.168.2.10/1514) to inside:192.168.1.2/1026 (192.168.2.14/1163)
Expand Down Expand Up @@ -1457,19 +1460,26 @@ Jan 8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
<order>id, srcip</order>
</decoder>

<decoder name="pix-srcip">
<decoder name="pix-enable-failed">
<parent>pix</parent>
<prematch offset="after_parent">^6-308001</prematch>
<regex offset="after_parent">^(\S+): \.+ (\S+)</regex>
<order>id, srcip</order>
<regex offset="after_parent">^(\S+):</regex>
<order>id</order>
</decoder>

<decoder name="pix-srcip-port">
<decoder name="pix-srcip-port-denied">
<parent>pix</parent>
<prematch offset="after_parent">^6-605004|^6-605005</prematch>
<prematch offset="after_parent">^6-605004</prematch>
<regex offset="after_parent">^(\S+): Login (\S+) from (\S+)/(\d+)</regex>
<order>id, action, srcip, srcport</order>
</decoder>

<decoder name="pix-srcip-port-permitted">
<parent>pix</parent>
<prematch offset="after_parent">^6-605005</prematch>
<regex offset="after_parent">^(\S+): Login (\S+) from (\S+)/(\d+) \.+user "(\w+)"</regex>
<order>id, action, srcip, srcport, user</order>
</decoder>
</decoder>

<decoder name="pix-generic">
<parent>pix</parent>
Expand Down