Checkpoint Question (etsh911)
Results 1 to 4 of 4

Thread: Checkpoint Question (etsh911)

  1. #1
    Senior Member
    Join Date
    Jan 2002
    Posts
    458

    Checkpoint Question (etsh911)

    We are currently using some PERL scripts to extract the IP's of all objects from our objects.C file and then running a daily script (occurences.pl) for a period of 30-days to determine which objects in the firewall have not been used for that 30 days, so they can be reviewed and possibly removed at the end of the 30 day period.

    So basically, once we have a file containing all the object IP's....Approximately 4000 objects , we run the PERL script which takes the ASCII log file and compares the IP list to it. Anything that is not matched in the log file, is written to an output file which then becomes the new input for the next day.

    SO..My question is once we have the list of IP's that have not been used, and we run another script to associate the object name with each IP address, is there any way to also determine which rule(s) each object is being used in. We are currently doing this manually and it is a very long process as you could imagine. I am not sure if this is possible, but it doesn't hurt to ask....
    Share on Google+

  2. #2
    Member
    Join Date
    Feb 2002
    Posts
    42
    I think what your looking for is fwprint at http://nic.com/~dave/Security/fwprint.html this babe could translate most of FW-1 files to human readable output, check the documentation on the -n flag, I think it's what your looking for.

    Ciaz
    etsh911
    Share on Google+

  3. #3
    Senior Member
    Join Date
    Jan 2002
    Posts
    458
    Beautiful....looks like this is exactly what I am looking for. I will be trying it out today though to make sure. thanks alot!!
    Share on Google+

  4. #4
    Member
    Join Date
    Feb 2002
    Posts
    42
    Any time mate
    Share on Google+

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides