Network Security

There seams to be a problem with the signature Net Flood TCP. The Cisco Intrusion Prevention sensor is installed in promiscuous mode and is at version 5.1(2) S247.0. The signature is enabled for rate 0 and to produce at alert.signatures 6920 0 status...

Hi friends,Just wanted to know a few things. The platform is confined to ASA 5540 and version 7.01.Can I not telnet into one of standby's interface Ip's? This is just to check if it has the same configuration as the active one? I just want to escape ...

Hello, I have two Pix 515Es in a failover configuration. The pixes are running 6.2(2). We have an issue where the primary will fail to the secondary and then later the secondary will fail back to the primary. This issue sometimes is happening 2 to 3 ...

What does it mean when an alert lists 0.0.0.0 as the source that triggered the signature?

To the Cisco IPS team, thank you for updating the IEV to 5.2. From what I've seen so far, it's a very nice improvement to 5.1.Email alerts are very nice to have. The only thing really missing from a SMB perspective is better reporting. Top 10's are n...

Our campus policy for dorms(college) is to not allow inbound connections, however it appears the latest version of ARES gets around that. We can now identify traffic as the start of a new connection as: The connect packets are always 46 bytes long, a...

Hi all,I am trying to use Output interpreter through RME. When i use the button "analyze output" in the netshow section of RME it does not work. The NetShowClient.log:[ mar sep 19 18:46:37 BST 2006 ],INFO ,[Ajp13Processor[9009][6]],com.cisco.nm.rmeng...

Hi I am slightly confused about this kit. We just want to implement ASA 5510 as IDS at the moment ;doing no more than just watching Traffic from one Vlan. My questions are1) I have configured it in Promis. mode. I have configured Port Span on the swi...

Hi ASA 5510 with OS ver 7.2(1), it is not allowing to pass the traffic thru tunnel for more than two RVPN tunnels. Ping, RDP everything works fine for 2 tunnels. From 3rd tunnel will get established, but will pass only sent traffic, no return traffic...

How can i reimage a sensor?Thank you

Hi All,I'm facing a problem in both IPS module(AIP-SSM-10) in ASA5520 and VMS IDSMC. The symptom is that in begining, I first update IDSMC to 5.1.1g(Minor update) with simultaneous pushing 5.1.1g pkg file to IPS sensor. But because this sensor has no...

I spoke to the sales folks at Cisco and they told me the Cisco ASA 5500 is stackable to 2 appliances. I went on line to fine instructions on how to stack them and couldnt find anything.Are they stackable?If so can you point me to some docs on how to ...

This signature appears to be looking for script markers in the header, but is firing on just the presence of 'script' which is not a problem. Example:000000 47 45 54 20 2F 42 75 72 73 74 69 6E 67 53 63 72 GET /BurstingScr000010 69 70 74 2F 61 64 64 6...

Does the 3060 provide Radius attribute 64 (Tunnel Type) in its Radius accounting? I cannot seem to get any Tunnel Type information with ACS Radius accounting.

I need to create reports for two things:How many users (IPs) hit our website more than once per day,and How many users browse our site for more than 20 minutes at a time.Since these "events" are normal and not breaking any "rules" can I query or repo...