Firewall Log Parser

Paste iptables/nftables, UFW, Windows Firewall, or pf log lines (or a generic CSV/key-value export) and this extracts source/destination IPs and ports, protocol, and action into a searchable table, with summaries for top talkers, most-blocked ports and destinations, and traffic over time. Denied or dropped traffic is never labeled malicious by default — a lot of it is scans, misconfiguration, or normal noise. Runs entirely in your browser — your file is not uploaded.

Cross-tool lookups (Port Reference, IOC Lookup, DNS Lookup) open a new page and, for IOC/DNS Lookup, perform a live network request — only when you click one.

Supported formats

Reliably parsed: Linux iptables/nftables kernel-log lines (the IN=… OUT=… SRC=… DST=… block, including a [UFW BLOCK/ALLOW] prefix when present), Windows Firewall pfirewall.log lines (using its #Fields: header when present, otherwise the standard default column order), and common pf syslog messages (rule N … block/pass in/out on IFACE: SRC.PORT > DST.PORT). Generic CSV exports (with a header row) and generic key=value network logs are recognized when field names are common ones like src_ip/action/proto. Vendor-specific formats beyond these aren't claimed as supported — add them by extending the detector list in this page's source rather than assuming an unlisted vendor format will parse correctly.