How to see source ip and destination ip traffic

[AD01]

Hi fellow net admins!

Just wanting to know if there is this page to see the source IP and destination IP that being passed or blocked?

If so, where do we see that?

br,

-AD

[MarcP]

you mean one of the following?

Before you need to go to network - generel and select "detailed traffic analyse"

Network - Traffic analyses

network - packet capture

clients detail page

[AD01]

Hi MarcP, thanks for the response. yeah, that's good, it give you somehow general apps/traffic visibility. Not exactly like Palos for e.g., when you're trying to look for src IP and dst IP.  A simple and straightforward visibility.

[PhilipDAth · Accepted solution]

Packet capture is your best friend to see what is being allowed.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi... 

Amazingly, Meraki is the only firewall product I know of that doesn't have an easy way to see what traffic is being blocked.  You have to use syslog.

I'm been contemplating writing a syslog "server" in Python, purely to provide an easy way to be able to have something I can start on my computer to watch for short periods of time what is being blocked or allowed.

[rhbirkelund]

---

@PhilipDAth wrote:
..

I'm been contemplating writing a syslog "server" in Python, purely to provide an easy way to be able to have something I can start on my computer to watch for short periods of time what is being blocked or allowed.

---

Something liket this? - https://gist.github.com/marcelom/4218010

[PhilipDAth]

That is excellent!  I'll take a closer look and see how I can make it more useful for firewalling.

[AD01]

Hi PhilipDAth, appreciate your response. Yeah, it seems this would be a "nice to have" future feature. I think it is extremely useful considering it is a FW device.