topic Re: Packet Capturing in Network Security

Packet Capturing

b.bader — Sun, 10 Mar 2019 09:34:10 GMT

I see other postings asking about configuring capturing on the IDSM, but is it possible to do this with and IDS 4235?

Re: Packet Capturing

beth-martin — Tue, 09 Aug 2005 14:53:20 GMT

I guess you have missed out something here what is the other device??

Re: Packet Capturing

b.bader — Tue, 09 Aug 2005 16:41:50 GMT

I guess I meant to type "a" not "and". The 4235 plugs into a Catalyst 6509, but not sure that is relevant. I am wondering only if the 4235 can do packet capturing based on an alert.

Thanks

Re: Packet Capturing

nhoover — Sat, 20 Aug 2005 06:08:34 GMT

You can set packet capture or ip logging on any signature. If you connect to the IDS via the IDM interface you can navigate to the signature configuration mode which is nested under configuration - sensor engine - signature configuration mode - all signatures - and then chose which signature you would like to enable the packet capture on and choose edit. You will be presented with a list of variables that you can change for that specific signature. One of the variables is packet capture, set this to true to enable. If you would like a log of traffic between the attacker and the victim you can enable ip logging for that signature. Care should be taken when enabling ip logging on a large amount of signature as this could cause performance issues. You might also want to limit the size of the ip logs if you use this signature other wise you might end up with pretty large log files. Please let me know if you need any more clarification on the process.