Here's a link to some good information on firewall forensics. www.robertgraham.com/pubs/firewall-seen.html