Forum Discussion

Zero27351's avatar
Zero27351
Icon for Altostratus rankAltostratus
Apr 20, 2022

Portscan detected from f5 snatpool?

Hi Guys, So we have a security incident in wich a portscan is detected coming from our f5 snatpool towards another specifiek machine. Is there any logging i can check to see from which machine the...
devops
security
Zero27351's avatar
Zero27351
Icon for Altostratus rankAltostratus

Hi Dario,

Thanks! Ill give it a try once we see it happening again. There is otherwise no logging which i can check to figure out the origin adres?

Kr,

Zero.

Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP
Apr 21, 2022

Hello Zero27351.

There are no records for old flows, but you can create an iRule for logging those sessions and apply it to the VS. Or even better, create a Request-Logging profile.

Logging connections using High Speed Logging

https://github.com/DariuSGB/F5_iRules/blob/master/HSL_Logging.tcl

Request logging profile

https://support.f5.com/csp/article/K00847516

In both cases, I recommend you send those logs to an external device, to not affect the local system performance.