Tcp Reset question - IPS Sensor 4255

pmichaelson — Sun, 10 Mar 2019 09:47:56 GMT

I have this sensor doing tcp resets, the question I have is if I add a network to the "never block addresses" will the sensor still send tcp resets even though the network is in the never block? if so how do I tell the sensor to not block certain ip addresses..

Thanks in advance

Phil

Re: Tcp Reset question - IPS Sensor 4255

smalkeric — Mon, 19 Dec 2005 18:50:28 GMT

You can configure sensors to send TCP reset packets to try to reset a network connection between an attacker host and its intended target host. In some installations when the interface is operating in promiscuous mode, the sensor may not be able to send the TCP reset packets over the same sensing interface on which the attack was detected. In such cases, you can associate the sensing interface with an alternate TCP reset interface and any TCP resets that would otherwise be sent on the sensing interface when it is operating in promiscuous mode, are instead sent out on the associated alternate TCP reset interface.

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_installation_guide_chapter09186a008055fc77.html

topic Re: Tcp Reset question - IPS Sensor 4255 in Network Security

Tcp Reset question - IPS Sensor 4255

Re: Tcp Reset question - IPS Sensor 4255