Cisco pix ports report

[pcarron]

Hi,
I need to know what ports are actualy being uside on my Pix firewall.
How do I generate a report for all ports used (one for inside interface and one for outside)including source and destination IP addresses.

[MHibbin]

You should probably look at the Cisco Security Suite App, and Splunk for Cisco Firewalls App.

Alternatively if you want to create you own....

Without seeing the data... I imagine that you will just need to define your fields (where they have not already been extracted. (guide here)

You will then probably need to use a stats command on the data (one for internal zones, one for external zones). This would be something like (depending on the fields you have extracted).

sourcetype=ciscoPix | stats count by port srcIP dstIP

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Stats

Or you could use things like top.