Forum Discussion

Leannadanna's avatar
Leannadanna
New Contributor
5 years ago

Understanding entries and timestamps in panoramic wifi gateway logs

When logged into my wifi gateway, I can see "system", "firewall", and "event" logs. My questions is regarding the firewall logs specifically.

I've noticed there is a huge difference between the "number of attempts" from one time stamp to another.

Is that determined by the length and level of activity of the user?

Also, what does the timestamp imply? Is that the time at which activity, or a certain type of activity, was ended? Or when it began? Does it represent a set time period? Should they correspond with time stamps for system and event logs?

FW.WANATTACK DROP, 3 ATTEMPTS, 2020/3/26 05:58:01     FIREWALL BLOCKED

FW.WANATTACK DROP, 432 ATTEMPTS, 2020/3/11 10:59:01  FIREWALL BLOCKED

FW.IPv6 FORWARD drop, 148 Attempts, 2020/3/17 16:58:01    FIREWALL BLOCKED

FW.IPv6 FORWARD drop, 9073 Attempts, 2020/4/14 16:58:01 FIREWALL BLOCKED

FW.IPv6 INPUT drop, 1 Attempts, 2020/3/28 12:58:01                FIREWALL BLOCKED

FW.IPv6 INPUT drop, 9467 Attempts, 2020/4/20 12:58:01          FIREWALL BLOCKED

I'm also curious what the entries mean, as in the difference between a FORWARD DROP and an INPUT DROP. But I've asked a lot already.

Thanks so much for your time!

log entries
time stamps
wifi logs
  • Jellygrape's avatar
    Jellygrape
    New Contributor II
    5 years ago

    My logs show a similar pattern:

    All logs from Last Week
    FW.IPv6 FORWARD drop , 238 Attempts, 2020/5/06 17:30:46 Firewall Blocked
    FW.IPv6 INPUT drop , 26 Attempts, 2020/5/06 17:18:44 Firewall Blocked
    FW.IPv6 FORWARD drop , 7339 Attempts, 2020/5/06 16:58:01 Firewall Blocked
    FW.IPv6 INPUT drop , 105 Attempts, 2020/5/06 16:58:01 Firewall Blocked
    FW.IPv6 FORWARD drop , 7484 Attempts, 2020/5/05 16:58:01 Firewall Blocked
    FW.WANATTACK DROP , 58 Attempts, 2020/5/05 13:58:01 Firewall Blocked
    FW.IPv6 INPUT drop , 10 Attempts, 2020/5/05 01:13:17 Firewall Blocked
    FW.LAN2SELF DROP , 9 Attempts, 2020/5/04 23:54:15 Firewall Blocked

    Cox's router is doing its job at preventing outside access into your network. I presume that nefarious parties target the large IP ranges of ISPs. Last week, I had a different Cox IP address, yet the firewall logs showed the same type of results.

  • Tdawgg's avatar
    Tdawgg
    New Contributor
    5 years ago

    I really don't know but it seems like someone or something is attempting to hack into your network.