This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Help

Who rated this post

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Timothy_Hall
MVP Gold
MVP Gold
‎2023-06-15 03:02 PM
In response to dergio

Someone has turned on TCP state logging which is not enabled by default.  This feature was mentioned in my Max Power 2020 book, pages 319-322.  See sk101221: TCP state logging

Looks to me like in your case the TCP state updates are not being properly tacked on to the existing log entry; I would speculate that perhaps you only have session logging enabled for the rule matching this connection, but not connection logging which is I imagine where the TCP state updates will need to go.  For the difference between the two see my 2022 CPX speech Max Gander: The Hidden World of Log Generation and...

Gaia 4.18 (R82) Immersion Tips, Tricks, & Best Practices Video Course
Now Available at https://shadowpeak.com/gaia4-18-immersion-course

View solution in original post

(1)
Who rated this post