The difficulty is that I'm trying to enable the anti-spoofing function, so I can't work backwards based on what I can currently see. In other words I don't know if Juniper is aware of anti-spoofing on ScreenOS, "notes" that packets don't match the routing table but takes no action until anti-spoofing is enabled, or does it have no awareness of the concept of anti-spoofing until it is enabled? Obviously I want to know what to expect to see if I experience problems related to anti-spoofing before I enable it on my client's equipment, hence the challenge. I also administrate the firewalls but the difficulty still applies. Thanks for replying. ... View more

Firewall logs are sent to SPLUNK. I go through these having set the index i.e. index=juniper-syslog. However I do not know how to search for packets dropped by anti-spoofing. Any suggestions on which search options I should select? ... View more

The aim here is to use Splunk to analyse firewalls. The requirement is to use Splunk to see if any IP spoofing attacks have occurred. Using index=checkpoint-opsec I am able to, for example, analyse the logs but which value in Checkpoint\ Juniper represents a spoofing attack or drop due to anti-spoofing on the firewall? ... View more