I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

[btb2018]

How can I use SPLUNK to detect packets dropped by the Juniper ScreenOS because of anti-spoofing configuration on the firewall.?

Any help would be received,

Brian

[lakshman239]

Does the Juniper f/w logs log these events? If yes, can you see them in the syslogs received from them? If we can identify these events with the help of Juniper f/w admins, you will be able to create a search.

[btb2018]

Firewall logs are sent to SPLUNK.
I go through these having set the index i.e. index=juniper-syslog.
However I do not know how to search for packets dropped by anti-spoofing.
Any suggestions on which search options I should select?

[lakshman239]

unfortunately, i don't have juniper logs to test, but if you show the events from your above search to Juniper f/w engineer and ask them to show you the events specific to packets drop, you can then create a search OR post back those samples.

You may also want to look at https://kb.juniper.net/InfoCenter/index?page=content&id=KB6991&cat=SCREENOS&actp=LIST

[btb2018]

The difficulty is that I'm trying to enable the anti-spoofing function, so I can't work backwards based on what I can currently see.
In other words I don't know if Juniper is aware of anti-spoofing on ScreenOS, "notes" that packets don't match the routing table but takes no action until anti-spoofing is enabled, or does it have no awareness of the concept of anti-spoofing until it is enabled?
Obviously I want to know what to expect to see if I experience problems related to anti-spoofing before I enable it on my client's equipment, hence the challenge.
I also administrate the firewalls but the difficulty still applies.

Thanks for replying.

[nsommars]

We have kind of the same problem.
However, this is no Splunk issue...Netscreen firewall logs does not contain those packets because they are dropped before they hit the firewall functionality in ScreenOS.