The log
The log shows every packet and event on a separate row.
The rows show the date and time, type of protocol, from interface, computer and port, to interface, computer and port, ICMP type for ICMP traffic, flags, whether the packet was accepted, rejected or discarded, and the reason for this. For TCP traffic, and for UDP traffic which is session managed, only the connection packet is displayed. SIP media streams are not logged.
The firewall's own IP address is displayed in the log with a purple background color. Rejected and discarded packets are displayed with a yellowish background.
The following flags are used:
| S | SYN | Request for connection |
| A | ACK | Response to a previous packet |
| U | Urgent | Contains out-of-band data |
| P | Push | Packets that must be delivered quickly |
| F | FIN | Disconnect request |
| R | RST | Reset - response to incorrect packet |
For more information on flags, see RFC 793.
When the clock is reset, the log shows this on a separate line like this:
If the firewall is restarted, the log shows this on a line like this:
