<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Create communication matrix from CSV logexport</title>
	<atom:link href="http://stoneblog.stonesoft.com/2009/06/create-commuinication-matrix-from-csv-logexport/feed/" rel="self" type="application/rss+xml" />
	<link>http://stoneblog.stonesoft.com/2009/06/create-commuinication-matrix-from-csv-logexport/</link>
	<description>Share knowledge about StoneGate</description>
	<lastBuildDate>Wed, 08 Feb 2012 09:11:13 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: Bernd Bornkessel</title>
		<link>http://stoneblog.stonesoft.com/2009/06/create-commuinication-matrix-from-csv-logexport/comment-page-1/#comment-103</link>
		<dc:creator>Bernd Bornkessel</dc:creator>
		<pubDate>Fri, 26 Jun 2009 15:09:29 +0000</pubDate>
		<guid isPermaLink="false">http://stoneblog.stonesoft.com/?p=1418#comment-103</guid>
		<description>Hi,

please make sure that you filter out any log entries like IPSec Info, Authentication, Accounting before you export the logs.
Filter for events like &quot;New Connection&quot;, &quot;New Connection through VPN&quot;, &quot;Connection Discarded&quot; or any combination of these.

Of course we could do this job also in the script. But as the export file would grow including all logentries, the script performance and memory consumption would increase radically.

Perhaps you should also have a look to the fields of the exported csv File. The line
resultFields = (7, 8, 9, 12, 14, 15)
describes which fields of the export file are taken over to the result file. Remember to start counting from 0. The first field is &quot;Src Addr&quot;, second &quot;Dst Addr&quot;, third &quot;Service&quot;, fourth &quot;Dst Port&quot;. The last two ones are optional. In this case source NAT and destination NAT.

Regards,
Bernd</description>
		<content:encoded><![CDATA[<p>Hi,</p>
<p>please make sure that you filter out any log entries like IPSec Info, Authentication, Accounting before you export the logs.<br />
Filter for events like &#8220;New Connection&#8221;, &#8220;New Connection through VPN&#8221;, &#8220;Connection Discarded&#8221; or any combination of these.</p>
<p>Of course we could do this job also in the script. But as the export file would grow including all logentries, the script performance and memory consumption would increase radically.</p>
<p>Perhaps you should also have a look to the fields of the exported csv File. The line<br />
resultFields = (7, 8, 9, 12, 14, 15)<br />
describes which fields of the export file are taken over to the result file. Remember to start counting from 0. The first field is &#8220;Src Addr&#8221;, second &#8220;Dst Addr&#8221;, third &#8220;Service&#8221;, fourth &#8220;Dst Port&#8221;. The last two ones are optional. In this case source NAT and destination NAT.</p>
<p>Regards,<br />
Bernd</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: pakki</title>
		<link>http://stoneblog.stonesoft.com/2009/06/create-commuinication-matrix-from-csv-logexport/comment-page-1/#comment-101</link>
		<dc:creator>pakki</dc:creator>
		<pubDate>Wed, 24 Jun 2009 10:50:19 +0000</pubDate>
		<guid isPermaLink="false">http://stoneblog.stonesoft.com/?p=1418#comment-101</guid>
		<description>Hi, sounds like a usefull tool.

However, I tried this but I got results like &quot;UDP 6394613&quot;. My python skills is not sufficient that I could fix that. :-(</description>
		<content:encoded><![CDATA[<p>Hi, sounds like a usefull tool.</p>
<p>However, I tried this but I got results like &#8220;UDP 6394613&#8243;. My python skills is not sufficient that I could fix that. <img src='http://stoneblog.stonesoft.com/wp-includes/images/smilies/icon_sad.gif' alt=':-(' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
</channel>
</rss>

