Hey there, Maybe someone can point me in the right direction trying to understand logs.
This is what logging on a specific source ip looks like:
- flow from .107 to .113 on TCP/102 is allowed and shows "ICCP"
- flow from .107 to .111 on TCP/102 is rejected and shows a custom service definition (don't know why that was set up for the same port)
The custom service is set as "match for Any"
Now the questions are
1) Why does the allowed flow show ICCP as the service while rule 156 contains the custom service definition and not ICCP?
2) Why does the reject flow show the custom service?