Verify TCP reset is actually working

pmichaelson — Sun, 10 Mar 2019 09:42:30 GMT

How do I see if the TCP reset is working,

I have IDM, IEV, IDS MC, and for some reason I cannot locate the information

Thanks in advance

Re: Verify TCP reset is actually working

a.kiprawih — Mon, 24 Oct 2005 05:06:04 GMT

Hi,

Beside logging direct to IDM or using IDS MC, you may use IEV to view the tcp reset action taken by the IDS.

1. Launch your IEV

2. Under 'View', double-click the "Sig Name Group".

2. Right-click the log associated to the signature you've selected, for example "TCP Segment Overwrite" (SID 1300)

I assumed you have already set the "EventAction" under your selected signature (tcp-based) to include 'reset'.

3. Back to IEV, right-click the signature log and choose 'Expand Whole Details'. A window will popup with details on the attack log.

4. Right-click this event, and choose 'View Alarms'.

5. Scroll to the right, and look under 'TCP Reset Sent'. If the stated value is 'true', the IDS has performed the tcp reset to the attack event.

Cheers!

pmichaelson — Wed, 26 Oct 2005 12:05:54 GMT

Thanks for the information, very helpful