How to find green IP that is sending traffic to hostile network

How to find green IP that is sending traffic to hostile network

[Tim Zakharov]

At Status->Network (other)->Firewall Hits Graph I sometimes see values 
in the 'To Hostile Networks' line beneath the graph, which tells me a 
green IP attempted to send traffic to a Hostile Network.  In a forum 
conversation with Adolf Belka, I was guided to Export Firewall Logs for 
the day the event occurred and search for DROP_HOSTILE.  I did, but 
could only come up with RED traffic, not GREEN, during that time frame.  
For example:
> 2:13:11 DROP_HOSTILE IN= OUT=red0 SRC=70.164.192.226 DST=202.61.85.215 
> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=17688 DF PROTO=TCP SPT=57844 
> DPT=80 WINDOW=42340 RES=0x00 SYN URGP=0
Where SRC is my RED IP and DST is the hostile network.

I have seen DROP_HOSTILE IN=green0 traffic before, but it was while 
browsing through Logs->FWLoggraphs (IP) when I happened to randomly 
click on a green IP that had attempted a connection with a hostile network.

I would like to find a quick, reliable way to see which GREEN IP 
attempted to connect to a hostile network.  Any ideas?

For reference, here is the forum post I referenced above:
https://community.ipfire.org/t/how-to-find-green-ip-that-is-sending-traffic-to-hostile-network/14098