Network Security

What does it mean when an alert lists 0.0.0.0 as the source that triggered the signature?

To the Cisco IPS team, thank you for updating the IEV to 5.2. From what I've seen so far, it's a very nice improvement to 5.1.Email alerts are very nice to have. The only thing really missing from a SMB perspective is better reporting. Top 10's are n...

Our campus policy for dorms(college) is to not allow inbound connections, however it appears the latest version of ARES gets around that. We can now identify traffic as the start of a new connection as: The connect packets are always 46 bytes long, a...

Hi all,I am trying to use Output interpreter through RME. When i use the button "analyze output" in the netshow section of RME it does not work. The NetShowClient.log:[ mar sep 19 18:46:37 BST 2006 ],INFO ,[Ajp13Processor[9009][6]],com.cisco.nm.rmeng...

Hi I am slightly confused about this kit. We just want to implement ASA 5510 as IDS at the moment ;doing no more than just watching Traffic from one Vlan. My questions are1) I have configured it in Promis. mode. I have configured Port Span on the swi...

Hi ASA 5510 with OS ver 7.2(1), it is not allowing to pass the traffic thru tunnel for more than two RVPN tunnels. Ping, RDP everything works fine for 2 tunnels. From 3rd tunnel will get established, but will pass only sent traffic, no return traffic...

How can i reimage a sensor?Thank you

Hi All,I'm facing a problem in both IPS module(AIP-SSM-10) in ASA5520 and VMS IDSMC. The symptom is that in begining, I first update IDSMC to 5.1.1g(Minor update) with simultaneous pushing 5.1.1g pkg file to IPS sensor. But because this sensor has no...

I spoke to the sales folks at Cisco and they told me the Cisco ASA 5500 is stackable to 2 appliances. I went on line to fine instructions on how to stack them and couldnt find anything.Are they stackable?If so can you point me to some docs on how to ...

This signature appears to be looking for script markers in the header, but is firing on just the presence of 'script' which is not a problem. Example:000000 47 45 54 20 2F 42 75 72 73 74 69 6E 67 53 63 72 GET /BurstingScr000010 69 70 74 2F 61 64 64 6...

Does the 3060 provide Radius attribute 64 (Tunnel Type) in its Radius accounting? I cannot seem to get any Tunnel Type information with ACS Radius accounting.

I need to create reports for two things:How many users (IPs) hit our website more than once per day,and How many users browse our site for more than 20 minutes at a time.Since these "events" are normal and not breaking any "rules" can I query or repo...

we have two 6513 switches as core, but only 1 IDSM2 on switch 1, the connection between the two swithches is layer 3? how we can copy the traffic from the switch 2 (without idsm2) to the switch 1 (with idsm2).

i can log in AIP SSM-10 on ASA 5510 using session 1 command but when i want to initialize it by running Setup command Unrecognized Comand Error althogh Power LEd is green, what is problem?

Hey guys, We have just implemented NAC (L2 IP) and have it working on switchports assigned to a data VLAN. We are however having problems checking PC's that are hooked into a phone. The phone is on a voice vlan and the pc is on the data vlan. I would...