As I start doing research for my Introduction to Firewalls book I'm looking at some of the information that is out on the Internet that I've always recommended. Two resources that I often suggest are the Firewall FAQ at Interhack and Robert Grahams "What am I seeing" Firewall Forensics FAQ for Firewall logs.
The Firewall FAQ does an excellent job or answering most of questions that someone who is new to network security would ask.
In the description of the Firewall Forensics FAQ the author says it explains what you'll see if Firewall logs and 'especially port numbers". This is a great reference for port to application and specifically hostile port to application mapping.
Both of these are great non product specific resources.
No comments:
Post a Comment