Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Norbert_Anderss
Explorer

Filtering out IPS alerts with PCAP

Hi

Wondering if there is any way to filter out IPS alerts which have a pcap file attached in SmartLog? If not, is there any other way to see the pcap files, where are they stored? I'm running version r80.30 on the log server.
Best Regards
Norbert

0 Kudos
1 Reply
Timothy_Hall
Champion
Champion

For R80.10+ gateways, IPS packet captures are automatically transferred to the Log Server (usually the SMS or CMA) and
stored in the $FWDIR/log/forensics and /var/spool/mail directories.

New 2021 IPS/AV/ABOT Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos