Not that I would call myself a PIX expert by any stretch of the imagination but... That would be received bytes, you can tell by the port number. This is your SMTP ACL(or conduit) bound to your outside interface ) If you look a few lines before that line in your log you will see where the connection was actually made, it will look something like: %-6-302001: Built inbound TCP connection 2388276 for faddr xxx.xxx.xxx.x/60562 gaddr yy.yy.yyy.yy/25 laddr zzz.zz.z.zz/25 cheers.. Marc. >>> [EMAIL PROTECTED] 09/20 3:34 AM >>> Hello there, I'm seeking some help from a PIX expert. I'm writing an application to create HTML reports from PIX firewall logs, but I am stuck on one thing. I am trying to determine if the byte count in the log refers to sent or received traffic. For example: %PIX-6-302002: Teardown TCP connection 2388280 faddr xxx.xxx.xxx.x/60562 gaddr yy.yy.yyy.yy/25 laddr zzz.zz.z.zz/25 duration 0:00:01 bytes 3219 (TCP FINs) Is the 'bytes' count indicating sent or received traffic from the PIX? When finished, the program will go by the name of "RnR ReportGen for Pix". The home page will be http://www.rnrsoft.com I am also in need of about five beta testers, so if anyone is interested please let me know. Thanks in advance Ralph RnR Software http://www.rnrsoft.com ------------------------ Yahoo! Groups Sponsor ---------------------~--> Secure your servers with 128-bit SSL encryption! Grab your copy of VeriSign's FREE Guide: "Securing Your Web Site for Business." Get it Now! http://us.click.yahoo.com/4mr93B/zhwCAA/yigFAA/kgFolB/TM ---------------------------------------------------------------------~-> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ _______________________________________________ Firewalls mailing list [EMAIL PROTECTED] http://lists.gnac.net/mailman/listinfo/firewalls
