source and destination problem with Sidewinder f/w messages
I have envision ES 4.0 build 0236.
I'm getting messages from from a sidewinder G2 firewall, but for some messages - e.g t_nettraffic - it is getting the source and destination the wrong way around.
The message file is dated 19 August.
In most sidewinder messages the srcip = saddr
But in the messages where the source and dest are wrong, the message says srcip=laddr.
is it simply a case of editing the xml? so that srcip= saddr?
When rebuilding the Sidewinder functionality they did not put resolution into the Firewall table so if you are like me and looking at ipaddr.tab data you will have to rewrite your reports to use the global table. I put this in as an enhancement request.