Assuming a firewall is properly setup, only allowing determined traffic and dropping everything else, what relevant information (if any) could I get from the log of the accepted rules?

From the dropped packets log I can identify non-legitimate traffic, but don't know whether is there any use of the accepted packets log.


Logging accepted connections can be used for traceability. This is often used when an intrusion has been detected to check if the offending host has connected to other hosts within your network. This is actually more useful in larger network environment where there are multiple entry points into a network.


Your goal is to understand your network traffic better than your adversary. Logging accepted traffic can tell you

  • What services are in use. If there is a sudden surge in a given service that is not tied to any business initiative, this could mean that your adversary has discovered and is exploiting your network.

  • What your normal traffic recipients are. If you suddenly experience a 100% surge in communications from a country/region that is not tied to a business initiative, this could be a security problem, or it could be a business opportunity.

  • Approaching limits. If your accepted traffic rises above 85% of your network bandwidth, then you're going to have a denial of service. Could be adversarial, could be self inflicted. Doesn't matter.

If you have an insider who is exfiltrating information, you can discover it through logging accepted traffic.

If you discover a problem, a review of accepted traffic may reveal when the problem started, and what information has been compromised. This can be critical to recovery.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.