topic Re: SmartLog TLS filter in Firewall and Security Management

SmartLog TLS filter

ziggurat — Tue, 22 Jun 2021 21:00:01 GMT

Hi guys

Hope someone can help. I'm looking to setup a filter on SmartLog that shows me all TLS 1.0 traffic but not TLS 1.2 traffic.

Is this filter correct?

Service:tls1.0 OR NOT Service:tls1.2

I tried AND instead of OR but that didn't work. When try just one or the other, the results seem to be same.

Many thanks

Re: SmartLog TLS filter

PhoneBoy — Sat, 22 Aug 2020 05:50:12 GMT

It seems like searching for service:TLS1.0 would show you only TLSv1.0 logs.
Is that not the case?

Re: SmartLog TLS filter

ziggurat — Sat, 22 Aug 2020 20:30:10 GMT

That's what I expected too, but when applied filter "Service:tls1.0" the log seemed to show the same traffic as filter "Service:tls1.2" - I began to wonder whether "Service:tls1.0" will show all traffic passing on 1.0 upwards.

I could be totally wrong but output seems the same with either filter. It's a head scratcher...

Re: SmartLog TLS filter

PhoneBoy — Mon, 24 Aug 2020 02:49:35 GMT

Maybe @Dan_Zada or someone on his team knows, but this may not be supported.

Re: SmartLog TLS filter

ziggurat — Mon, 24 Aug 2020 07:07:02 GMT

Many thanks, I'll continue fiddling around with the filter. Who knows, maybe I'll stumble across the solution 🙂

Re: SmartLog TLS filter

Mufaaa — Tue, 30 Mar 2021 08:09:14 GMT

Hi,
Did you find any solution to filter TLS version on SmartLog?
thanks