1

How we can discover IoT Devices used within a network in Firewall Logs?.

One of the way of discovering IOT devices is through mac address, but mac address is not available in log file. I have to work around with header(User-Agent, Source IP , Client IP and Request Url) to uniquely identify an IoT device.

I am getting logs from BlueCoat Proxysg. Fields available in firewall logs are https://origin-symwisedownload.symantec.com/resources/webguides/cacheflow/3x/3_4/webguide/Content/CPL/Access-Log-Fields.htm

I want to detect all kind of IOT Devices used in my networks.

3
  • 1
    You probably need to update the question to be a little more specific. Where are you collecting the logs and using what tools. Also are you looking to discover specific types of devices on your network or any devices present.
    – hardillb
    Jul 8 '19 at 13:37
  • 1
    "I want to detect all kind of IOT Devices used in my networks" - are we talking a closed LAN or WAN here, or can these devices be accessing your network form outside. If the latter, I doubt that it will be doable. Great question ! Jul 9 '19 at 8:19
  • in my WAN Network. Jul 9 '19 at 17:29