Telnet Page ‘c’ Security

Telnet Page c (or C) displays the last 16 security violations detected by the router. The format of page c is defined below. This page is updated every second.

Example of page c display

        Router Status page c (0010101490)

Security Status LockBox=OFF Access List=ON
Violations = 74773 BG = 6 LB In = 0 LB Out = 0 OK=0 Max=74767
V=4 C=8 S=207.35.76.24 D=207.35.76.255 P=17 SP=138 DP=138 T=7 D=1
V=4 C=8 S=207.35.76.24 D=207.35.76.255 P=17 SP=138 DP=138 T=7 D=1
V=4 C=8 S=207.35.76.24 D=207.35.76.255 P=17 SP=138 DP=138 T=7 D=1
V=4 C=8 S=207.35.76.24 D=207.35.76.255 P=17 SP=138 DP=138 T=7 D=1
V=4 C=8 S=207.35.76.3 D=207.35.76.255 P=17 SP=2020 DP=111 T=7 D=1
V=4 C=8 S=207.35.76.3 D=207.35.76.255 P=17 SP=2020 DP=111 T=7 D=1
V=4 C=8 S=207.35.76.3 D=207.35.76.255 P=17 SP=2020 DP=111 T=7 D=1
V=4 C=8 S=207.35.76.3 D=207.35.76.255 P=17 SP=2020 DP=111 T=7 D=1

Generic Format:

Security Status Lockbox = a Access List = b
Violations = c BG = d LB In = e LB Out = f OK = g Max = h
V = i C = j S = k.k.k.k D = l.l.l.l P = m SP = n DP = o T = p D = q

Where

Status Line

a = (Lockbox) May be ON or OFF

b = (Access List = GoodGuys list) May be ON or OFF

Summary Line

c = (Violations) The total number of violations, of all types, since the router was loaded.

d = (BG) The number of BAD GUY violations where an attempt was made to access the router from a IP address not in the goodGuyTable (excludes normal pings, but includes special diagnostic pings).

e = (LB In) The total number of times an incoming IP address has violated the incoming LockBox (Firewall) check rules defined by the user.

f = (LB Out) The total number of times an outgoing IP address has violated the outgoing LockBox check rules defined by the user.

g = (OK) The number of entries in the current LockBox 'allowed entry' list (OK List).

h = (Max) The maximum number of entries ever in the OK List since the router was loaded.

Security entry lines (maximum of 16)

Each line represents a single security violation and contains the following values

i = (V=) Violation Type. The type of violation may take one of the following values

0 = Bad Guy violation.
1 = LockBox incoming violation.
2 = LockBox outgoing violation.
4 = NAT incoming security violation

j = The Class of violation and may take one of the following values

0 = Bad Guy illegal Telnet or Router Loader access attempt
1 = LockBox no OUTGOING rule and outgoing enabled not set
2 = LockBox OUTGOING disallowed
3 = LockBox ICMP message received with ICMP_NONE set
4 = LockBox no rule for ICMP traffic found
5 = LockBox ICMP_PING set but not echo message
6 = LockBox Incoming TCP or UDP traffic disallowed
7 = Bad Guy illegal Ping attempted
8 = NAT incoming traffic with no Port Map
9 = Bad Guy illegal SNMP access attempted

k = (S=) Source IP Address. The source IP address that initiated the violation.

l = (D=) Destination IP address. The destination IP address of the violation.

m = (P=) Protocol. The protocol type, may take one of the following values:

1 = ICMP
2 = IGMP
4 = IP over IP
6 = TCP
17 = UDP

n = (SP=) Source port number. The source port number (not valid if P = 1 = ICMP)

o = (DP=) Destination port number. The destination port number (not valid if P = 1 = ICMP)

p = (T=) Time from midnight. The time (in minutes past midnight) when the violation took place (if a Time Service in use) or a relative time value if no Time Service being used).

q = (D=) Day number. The day number when the violation took place, values may be

1 = Sunday
2 = Monday
3 = Tuesday
4 = Wednesday
5 = Thursday
6 = Friday
7 = Saturday

NOTE: Day number is only valid if a Time Service is being used, if no Time Service is being used this value will be 0.