- [Presenter] Whenever you are studying for the CCNA
CyberOps SECFND exam
you learn what is the concept of the five tuple
but as a refresher here
I'm actually including the five elements.
That's the source IP address, the source port,
the destination IP address, the destination port,
and the protocol.
Now, traditional firewalls typically
provide security event logs that are mostly based
on the five tuple.
For instance,
a traditional Cisco ASA log may look like this, right?
In this example, the ASA dropped a TCP packet
that didn't have an associated connection
in its connection table.
In short, the ASA is actually looking for a syn flag
in the first packet of a TCP connection.
And in this case, actually it was not.
And the ASA drops that packet
that the syn flag was actually not set,
and there was no assisting connection
for that transaction or for that packet.
Now you also see the five tuple used in the IPS events.
You also see them in NetFlow records and other event data.
In fact, in the exam, you may actually need to differentiate
between a firewall log and a traditional IPS/IDS event.
One thing to remember
and I guess a quick tip is that traditional IDS
and IPS devices actually use signatures.
So one easy way to differentiate
is by looking for a signature ID in the output.
So if you see a signature ID, then most definitely
that event is a traditional IPS or IDS event.
And you saw a couple of examples
of a sys log message from a Cisco ASA.
And that will help you identify
what type of device log that may be referring to.