Hi all,
I have a 3850 L3 switch configured to send netflow to QRadar. Everything is working fine but recently I have seen some strange events popping up in netflow coming from this switch.
Recently we have tightened security with an ACL on a VLAN interface in inbound direction as we have found the users are generating malicious traffic. The ACL is pretty restrictive allowing specific ports and protocols to internal resources, allowing basic web surfing and at the end denying everything else.
The thing that is weird to me is that sometimes I see traffic to the IPs on the internet using UDP in the logs with destination packets and bytes at 0 which the ACL should block(when enabling log on the deny statement I can see the packets being dropped).
Also when checking the firewall I can see that no such UDP traffic reached it and went to the IP address on the internet.
An example of the logs I've been seeing from netflow are in the attachment.
Does someone have an explanation why would such logs pop up in netflow?
My own explanation is that traffic is indeed dropped by the ACL but somehow I get these logs from time to time that can be safely ignored. I would like to know if my explanation is correct or if something else is going on.
Thanks in advance for any help.
