1

I want to see how much traffic is coming from a class C network into my network. How can have the SRX only output the IP, date and time to a specific file?

Class C Network: 201.6.2.0/24
Log file: /var/tmp/incoming.log
Interface: ge-0/0/1
  • 1
    Network classes are dead, killed in 1993 by RFCs 1518 and 1519 for CIDR (Classless Inter-Domain Routing). Modern networking doesn't use network classes, please let them rest in peace. – Ron Maupin Feb 22 '17 at 18:16
2

There are a number of ways you could do this depending on what you mean by "how much traffic".

If you just want to log individual flows from that range, the following will work:

set system syslog file incoming.log any any
set system syslog file incoming.log match .*RT_FLOW.*201.6.2.*

Be aware though that running a regex match against all traffic passing through your SRX can be quite taxing on the CPU depending on how many flows you're currently seeing, and it would then be up to you to sum all the log entries to work out bytes in/out.

You might actually be better off exporting all your flow logs to an external syslog server, Junos Space Security Director, or an ELK stack and performing all your matching/filtering offline on the collected data.

Another, less CPU intensive method would be to create a specific security policy that matches on this prefix as a source address. You would then need to place it at the top of your security policies. Make sure the action is count, and then you can simply use:

show security policies policy-name PERMIT-201-6-2 detail

to get a nicely rolled up count of session hits, bytes in and bytes out for just this subnet.

The caveat to using this approach is that you'd need to make sure that the matching application contained all applications that would normally apply to "any" traffic coming from the same zone, so that you wouldn't give this prefix more or less access than it had before.

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.