topic Re: limiting by sessions in Network Security

limiting by sessions

rnaydenov — Sun, 10 Mar 2019 10:55:36 GMT

Hi guys,

Is there a way that I can make a custom signature to detect if any given host has reached a predefined limit of sessions to specific host. I know this can be done with ASA, but can it be done with IPS functionality?

Re: limiting by sessions

didyap — Wed, 09 Jan 2008 19:38:19 GMT

Following links may help you

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgeng.html

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgdef.html

Re: limiting by sessions

mhellman — Wed, 09 Jan 2008 22:43:48 GMT

Yes, you can do this. I assume you're talking about TCP sessions, right? Take a look at 3041-1, TCP SYN/FIN Packet. Copy it. Change the TCP flags to SYN. Change the TCP mask to SYN|FIN|ACK|RST|PSH|URG. Change the destination port range to the desired values. Change the event count and interval to the number of sessions that must be reached over the time interval before the alarm will fire.