Filter Incomplete Sessions on Palo Alto Firewalls (11 of 30)

A short tip today.

Here is a quick way to filer out in your logs packets that were never established (e.g. syn, but no syn/ack.)

(bytes_received geq 1) and (bytes_sent geq 1)

Of course if you are only getting a syn and not a syn/ack, the IP should probably be closed off all together, but you may have some situations where this is to be expected.


Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>