Files, a whole folder or rotated .gz logs. Several at once are merged and repeated lines skipped; add more any time.
Everything is parsed in this browser tab. Nothing is uploaded anywhere, unless you turn on the optional hostname lookups.
Optional extrasworld map and network owners, OPNsense rule names, blocklists
GeoIP database: drop a .mmdb (or .mmdb.gz) country and/or ASN database for the world map and network owners. It's kept in this browser.
OPNsense / pfSense names: drop a config backup (config-*.xml) and/or rule_ids.json to show interface and rule names instead of IDs. Only the names are kept.
Blocklists: drop a plain list of addresses and ranges (Spamhaus DROP, a FireHOL .netset, your own) to mark sources on it. Checked here, never looked up online.
Get your logs
1. Turn logging on
sudo ufw logging low: blocked packets that hit the default policy, plus rate-limited (LIMIT) ones.
medium adds allowed new connections (ALLOW) and invalid packets. high / full add AUDIT lines and are noisy.
Per rule: ufw allow log 22/tcp or ufw deny log-all ...
Any kernel line with SRC=, DST= and PROTO= works. The prefix becomes the action: drop, reject, deny or block count as blocks; accept, allow or pass as allowed; anything else as logged.
Or let fwscope-pull.py fetch it from the computer you run fwscope on:
python3 fwscope-pull.py ssh you@server --sudo
1. Turn logging on
Network → Firewall → edit the zone → Advanced settings → Enable logging on this zone (or option log '1' in /etc/config/firewall), then restart the firewall.
2. Grab the log
ssh root@openwrt 'logread' > openwrt.log
fw4 (22.03+) and fw3 lines both work. The verdict becomes the action and the zone the rule (wan in, src wan).
logread keeps only a small buffer. For history, send the log to a syslog server (System → System → Logging) and load that.
logread lines have no hostname: name the file after the router (gl-ax1800.log).
Or let fwscope-pull.py fetch it from the computer you run fwscope on:
python3 fwscope-pull.py openwrt root@192.168.1.1
1. Turn logging on
Each rule logs only if its Log box is ticked (Firewall → Rules → edit the rule).
The built-in default block and pass rules have their own switches under Firewall → Settings.
Or let fwscope-pull.py fetch it from the computer you run fwscope on (in an administrator prompt):
python fwscope-pull.py local --programs
1. Turn logging on
VPC console → your VPC (or a subnet or network interface) → Flow logs → Create flow log, with an S3 bucket as the destination. The default format is fine.
Network Watcher → Flow logs → Create, for a virtual network (VNet flow logs) or a network security group (NSG flow logs), with a storage account as the destination.
2. Grab the log
az storage blob download-batch -d ./azure -s insights-logs-flowlogflowevent --account-name YOUR_ACCOUNT
The hourly PT1H.json blobs. NSG flow logs live in insights-logs-networksecuritygroupflowevent. Each flow counts once, with the NSG rule as the rule.
Or let fwscope-pull.py fetch it from the computer you run fwscope on:
Ban, Unban, Found and "already banned" (F2B REPEAT) lines; the jail shows as the rule.
Load it with your firewall or WAF logs: scanners get marked fail2ban banned or not banned, and seen:f2b filters to the ones it banned.
Or let fwscope-pull.py fetch it from the computer you run fwscope on:
python3 fwscope-pull.py ssh you@server --sudo
1. Turn logging on
Alerts go to eve.json by default. On OPNsense: Services → Intrusion Detection → Administration → Enabled, with rule sets downloaded.
2. Grab the log
scp 'root@opnsense:/var/log/suricata/eve.json*' .
Alert events from eve.json (the rest are skipped) or fast.log. The signature shows as the rule; IPS drops count as blocks; seen:ids filters to sources Suricata alerted on.
Or let fwscope-pull.py fetch it from the computer you run fwscope on:
Blocks, challenges, logged and skipped events show as WAF BLOCK, WAF CHALLENGE, WAF DETECT and WAF ALLOW. The API returns at most 10,000 events per query; how far back depends on your plan.
Or let fwscope-pull.py fetch it from the computer you run fwscope on, with no 10,000-event limit:
Compared with what this browser saw on earlier visits (it keeps hashed addresses, not the addresses). Public sources only; ports count blocked traffic. Click to filter, shift-click to exclude.
Events over time
Drag across the chart to zoom into a time range. Double-click to reset.
Where sources come from
Add an IP-to-country and/or IP-to-network (ASN) database in .mmdb format to see this map. Drop it on the page or use the button. It's kept in this browser for next time, and every lookup happens locally.
DB-IP Lite: grab "IP to Country Lite" and "IP to ASN Lite" (MMDB). Free, no account, CC BY 4.0, updated monthly. The .mmdb.gz works as downloaded.
IPinfo Lite: country and ASN in one file, free with a sign-up.
CRS blocks a request once its inbound anomaly score reaches the threshold (5 by default), and a response once its outbound score reaches the outbound threshold. Pick a threshold to see what it would catch. "Possibly legitimate" means your own or LAN addresses, sources that mostly send a known crawler's user agent, or requests that tripped only protocol-policy rules and no attack rules.
Tuning suggestions
Rules that fire mostly on possibly legitimate traffic (verified crawlers, your own or LAN addresses) for one path or group of addresses. "Unblocks" is what excluding that rule there would change at the threshold picked above: possibly legitimate requests that would get through, and other requests (likely attacks) that would too. Click a row to see its requests.
New in the last
First seen in that window and never earlier in the loaded logs, within the current filter (try dpt:22 for new SSH sources). Click to filter. Shift-click to exclude.
Compare the last
with the one before, by
Both periods end at the newest event loaded and use the current filter (its time range aside). Sorted by the size of the change. Click a row to filter to it.
Top
Click a row to filter to it. Shift-click to exclude it.
Top
Click a row to filter to it. Shift-click to exclude it.
When it happens
events by weekday and hour, your local time
Scans and hammering
blocked sources sweeping many ports, or hitting the same port over and over
Block suggestions
Based on your WAF logs: sources the WAF caught attacking (web scans, web hammering, attack rules, fake crawlers) whose requests still reached the web app, as they do in detection-only mode. Firewall logs, if loaded, only add supporting evidence (a port scan, "firewall + WAF"); traffic your firewall already drops isn't a reason to block anything. Never suggested: your own and LAN addresses, Cloudflare's ranges, verified crawlers, and your never-block list. Three or more strong attackers in one /24 (IPv6 /64) are also offered as the whole range. Tick what to block, then write a script; nothing is applied from here.
Events
Loaded files
Add more with Add logs or by dropping files or folders anywhere. Removing a file re-reads the others, so large loads take a moment.