a) What packets are usually logged in log files?
b) What are the fields in the log file shown in Figure 6-25?
c) In the examples given, by what field was the log file sorted?
d) From the log file, what could we infer about the Echo probe attack?
e) Did this attack seem to be serious? Explain.
f) From the log file, what could we infer about the FTP attack?
g) Did this attack seem to be serious? Explain.
h) Why was the dropping of a single packet because of lack of firewall capacity a cause for concern?
i) What cannot be determined if log files cover too short a period of time?
j) Why is it difficult for a log file to cover a long period of time?
k) What is the advantage of logging all packets passing through a firewall?
l) Why is logging all packets problematic?