topic Re: ASA searching for current open connections that have been Built but with no teardown in Splunk Search

ASA searching for current open connections that have been Built but with no teardown

FC50 — Tue, 01 Dec 2020 13:49:12 GMT

Hello,

I'm pretty new to SPLUNK and I'm looking for help trying to find ASA open connections between two endpoints.

Most connections I search for have a 'Built' action and then some time after a corresponding 'teardown' action. I'm looking for those connections that have the 'Built' action but not the 'teardown' action.

The basic search I have pulls down all of the connections between the two:.

index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445

Is there a way to expand this search to find these open connections based on the absence of a teardown?

Is there a way to

Re: ASA searching for current open connections that have been Built but with no teardown

richgalloway — Tue, 01 Dec 2020 17:44:22 GMT

Here's one way to do that.

index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445 | dedup session,action | where action="built"

It assumes there is a field called "session" that uniquely identifies a connection between the two points. Change that to match whatever you have in your data.

Re: ASA searching for current open connections that have been Built but with no teardown

FC50 — Fri, 04 Dec 2020 17:41:57 GMT

Thanks for the response but no joy unfortunately.

It's still bringing up the thousands of results with the allowed action (I mistakenly called it built earlier) , and not showing just the few that only had the allowed action and not a corresponding teardown.

The allowed and teardown options do share a field called 'session_id' which is a long number

Re: ASA searching for current open connections that have been Built but with no teardown

richgalloway — Fri, 04 Dec 2020 18:03:43 GMT

I've tweaked my answer to only look for allowed and teardown actions and then leave only those sessions with the most recent action of "allowed".

Re: ASA searching for current open connections that have been Built but with no teardown

FC50 — Mon, 07 Dec 2020 13:40:31 GMT

Cool, thanks. That seems to have done the trick