topic Re: Traffic logs ports in Portal

Traffic logs ports

nesa0210 — Tue, 21 Mar 2023 09:06:08 GMT

Hello,

I am trying to find a way to search by destination port (TCP, UDP, ICMP...) in the infinity portal (Harmony Connect). Internet&Network Access ->Traffic logs. Is there a guide explaining what fields can we use for predefined search filters: Source, Destination, Service...?

I am looking to search for TCP 8883 for example.

Thanks,

Nenad

Re: Traffic logs ports

PhoneBoy — Wed, 22 Mar 2023 02:56:01 GMT

You should just be able to search for 8883 and get anything that mentions it (either source or destination port most likely).
I presume if you want to search on the service field (where TCP 8883 would appear), you can do a service:8883 as the search term.
See also (syntax should be the same in Infinity Portal): https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/Query-Language-Overview.htm?tocpath=Logging%7CWorking%20with%20Logs%7C_____2

Re: Traffic logs ports

the_rock — Wed, 22 Mar 2023 02:58:49 GMT

That would be syntax port:8883

Re: Traffic logs ports

nesa0210 — Wed, 22 Mar 2023 08:26:48 GMT

None of these work for me (searching using Service or Port). Maybe the issue is that when I find traffic (using the source and destination IP) I see "tcp-high-ports" as a service. Why not displaying exact port number?

Re: Traffic logs ports

PhoneBoy — Wed, 22 Mar 2023 20:10:01 GMT

Presumably because this is the service the port is matching.
It should show in the log card if you click on the entry.

Re: Traffic logs ports

Andrey_Kondor_1 — Thu, 25 Jan 2024 12:31:12 GMT

Hi! There is no port number for service in the log card. It shows only in Dashboard, not in SmartVew web console.