limiting by sessions

[rnaydenov]

Hi guys,

Is there a way that I can make a custom signature to detect if any given host has reached a predefined limit of sessions to specific host. I know this can be done with ASA, but can it be done with IPS functionality?

[didyap]

Following links may help you

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgeng.html

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgdef.html

[mhellman]

Yes, you can do this. I assume you're talking about TCP sessions, right? Take a look at 3041-1, TCP SYN/FIN Packet. Copy it. Change the TCP flags to SYN. Change the TCP mask to SYN|FIN|ACK|RST|PSH|URG. Change the destination port range to the desired values. Change the event count and interval to the number of sessions that must be reached over the time interval before the alarm will fire.