topic net flood tcp in Network Security

net flood tcp

darin.marais — Sun, 10 Mar 2019 10:12:51 GMT

There seams to be a problem with the signature Net Flood TCP. The Cisco Intrusion Prevention sensor is installed in promiscuous mode and is at version 5.1(2) S247.0. The signature is enabled for rate 0 and to produce at alert.

signatures 6920 0

status

enabled true

rate: 0 <defaulted>

event-action: produce-alert <defaulted>

My problem is that we do not receive any alert. Is there a logical reason for this and if so what is it?

Re: net flood tcp

smahbub — Fri, 15 Sep 2006 16:32:03 GMT

This happens probably due to a corrupt image. Try reloading the IPS image from a backup

Re: net flood tcp

darin.marais — Fri, 15 Sep 2006 18:17:54 GMT

i think it is a bug in 5.x. TAC are working on a solution right now....

Re: net flood tcp

darin.marais — Fri, 15 Sep 2006 22:28:50 GMT

Let me say this again. It?s not a bug with the sensor as the alert is received. The problem is that the vms server does not pull the alert from the sensor database.

Re: net flood tcp

darin.marais — Tue, 26 Sep 2006 11:32:21 GMT

for those having the same problem.

quote:

Patch for CSCsg09932 - SecMon does not display any alert for sig6920

rate if it helps