Join Mike Chapple for an in-depth discussion in this video Network monitoring, part of CompTIA Security+ Exam Prep (SY0-401): Network Security.
- View Offline
- Firewalls and network devices are on the front-lines…of security, and their logs contain…important information for security professionals.…These logs are useful when investigating…security incidents, troubleshooting network issues,…and monitoring for suspicious activity.…Firewall logs are one of the richest…possible sources of information.…When configured properly, firewalls create log entries…for each and every connection attempted on a network,…whether it was allowed or denied.…
The log entry contains quite a bit of useful information,…including details about the attempted connection,…including the source and destination ports…and IP Addresses, a timestamp indicating…when the connection took place,…and the identity of the firewall rule…that either authorized or denied the connection.…Let's think about some scenarios…where these logs might be very useful.…First, in the aftermath of a security incident,…the logs may show all of the connections…attempted on a network.…
This likely includes the connections used…
We are now a CompTIA Content Publishing Partner. As such, we are able to offer CompTIA exam vouchers at a 10% discount. For more information on how to obtain this discount, please download these PDF instructions.
- Working with the TCP/IP suite
- Securing switches and routers
- Configuring firewalls
- Setting up virtual private networks (VPNs)
- Detecting and preventing network intrusions
- Implementing unified threat management
- Using public and private network addressing effectively
- Segmenting networks
- Virtualization and cloud computing
- Managing secure networks