Network Monitoring and Logging with pfSense, Snort, and Splunk
ARTICLES
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=812,h=344,fit=crop/AMqp4k74qWsnW2XO/image-22-YNqy1JwlKgT24Nvb.jpg)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AMqp4k74qWsnW2XO/image-22-YNqy1JwlKgT24Nvb.jpg)
Monitoring and logging network traffic is one of the most critical aspects of cybersecurity. Without visibility into what’s happening on your network, you’re flying blind in a world full of threats. In this guide, I’ll walk you through configuring pfSense, Snort, and Splunk to create a powerful network monitoring and intrusion detection system. We’ll cover everything from setting up basic logging to using Splunk to analyze potential attacks.
Why Monitor Network Traffic?
Imagine your network as a busy city. Data packets are like cars, moving from one point to another. Without monitoring, you wouldn’t know which vehicles are authorized or which ones are breaking the rules. Tools like pfSense, Snort, and Splunk help you track and control this traffic, ensuring your network remains secure and functional.
Setting Up Basic Monitoring and Logging
The first step in any monitoring system is collecting data. In this section, I configured pfSense to log network events and set up Snort to detect potential intrusions.
Step 1: Configuring pfSense Logging
pfSense is a firewall and router solution that also provides excellent logging capabilities. Here’s how I set up logging:
1. Access the WebGUI
I opened a browser and navigated to http://172.30.0.1.
Logged in with default credentials: admin/pfsense.
2. Enable Firewall Logging
I went to Status > System Logs > Settings.
Enabled Log packets matched from the default block rules.
This ensures that all traffic blocked by the firewall is logged.
3. Limit Log Size
I set the number of log entries to 250 to make logs manageable.
4. Configure Remote Logging
Enabled Remote Logging and entered the IP address and port of the Kiwi Syslog Server:
172.30.0.2:514.
This forwards pfSense logs to a centralized server for easier analysis.
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=504,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_11.59.36_rec-YKb6ZNZ7ZWFppV5l.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=352,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_11.59.36_rec-YKb6ZNZ7ZWFppV5l.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=456,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.00.28_rec-mp8vZ7ZOZqtZzlOa.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.00.28_rec-mp8vZ7ZOZqtZzlOa.png)
Logs are the foundation of network monitoring. By enabling logging, I ensured every blocked packet and suspicious activity was recorded for future analysis.
Step 2: Setting Up Snort for Intrusion Detection
Snort is an intrusion detection system (IDS) that analyzes network traffic for malicious behavior. Here’s how I configured it:
1. Install and Activate Snort
I went to Services > Snort > Global Settings.
I enabled the Snort GPLv2 Community Rules and ET Open Rules for broad attack coverage.
2. Configure Pass Lists
Created a pass list called passlist_LAN_IDS to avoid false positives for trusted LAN devices.
3. Enable Snort on the LAN Interface
Assigned the LAN interface to Snort and enabled detection.
Activated specific rules like:
emerging-icmp_info.rules (for ICMP traffic analysis).
emerging-scan.rules (to detect network scans).
4. Test Intrusion Detection
Used the Diagnostics > Ping tool to send ICMP packets from the DMZ to the LAN.
Verified that Snort logged the pings as suspicious events.
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=464,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.12.58_rec-AE0olvl98XiaZ7Gn.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.12.58_rec-AE0olvl98XiaZ7Gn.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=376,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.27.01_rec-YBgr0y0D3WHK4RJQ.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=240,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.27.01_rec-YBgr0y0D3WHK4RJQ.png)
Why This Matters:
Snort acts as your network’s security guard, detecting and logging suspicious activities like scans or unauthorized access attempts.
Step 3: Forward Logs to Kiwi Syslog Server
Centralizing logs makes it easier to analyze events from multiple sources. Here’s how I forwarded logs to the Kiwi Syslog Server:
1. Configure pfSense for Remote Logging
In the Remote Logging Options, added the syslog server IP (172.30.0.2:514) to forward firewall and system logs.
2. Verify Logs in Kiwi
Opened the Kiwi Syslog application and confirmed logs were being received from pfSense in real time.
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=676,h=309,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.43.10_rec-mp8vZ7ZPMKCXNEWW.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=146,fit=crop/AMqp4k74qWsnW2XO/01.12.2024_12.43.10_rec-mp8vZ7ZPMKCXNEWW.png)
Why This Matters:
Centralized logging helps you monitor your entire network from a single location, saving time and effort.
Section 2: Advanced Monitoring with Splunk
For deeper insights and advanced event management, I integrated Splunk into the monitoring system. Splunk allows you to search, query, and visualize logs for effective threat analysis.
Step 1: Setting Up Splunk
1. Add pfSense Logs to Splunk
On the Splunk dashboard, clicked Add Data > Monitor > TCP/UDP.
Configured Splunk to listen on UDP port 514 for syslog data from pfSense.
Named the index pfsense_syslog for easy identification.
2. Verify Data Ingestion
Searched for indexed events in Splunk’s Search & Reporting app to confirm that logs were being received.
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=480,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.20.34_rec-AVLpENE9kViNlvz6.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.20.34_rec-AVLpENE9kViNlvz6.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=256,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.20.55_rec-A1awErEVB6iKGxJ3.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=176,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.20.55_rec-A1awErEVB6iKGxJ3.png)
Why This Matters:
Splunk transforms raw logs into meaningful insights, helping you identify patterns and anomalies quickly.
Step 2: Simulating and Detecting an Attack
To test the effectiveness of the monitoring system, I simulated a network attack using Nmap.
1. Perform a Network Scan
Used a Kali Linux machine to run the following Nmap command
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=440,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.28.41_rec-Yyv3j2jn18Uyb32M.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=293,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.28.41_rec-Yyv3j2jn18Uyb32M.png)
This scan sent a mix of TCP and UDP probes to identify open ports and services.
2. Analyze Alerts in Splunk
In Splunk, I searched for Snort to filter intrusion detection events.
Confirmed that Snort detected and flagged the Nmap scan as suspicious.
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=480,h=288,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.30.12_rec-mnlvD5De9bT37ynE.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=200,fit=crop/AMqp4k74qWsnW2XO/02.12.2024_06.30.12_rec-mnlvD5De9bT37ynE.png)
By combining pfSense, Snort, and Splunk, I built a strong monitoring system that logs, detects, and analyzes network traffic. Whether you’re managing a home network or a corporate environment, these tools offer a powerful solution for keeping your network secure.