net flood tcp

darin.marais · ‎09-11-2006

There seams to be a problem with the signature Net Flood TCP. The Cisco Intrusion Prevention sensor is installed in promiscuous mode and is at version 5.1(2) S247.0. The signature is enabled for rate 0 and to produce at alert.

signatures 6920 0

status

enabled true

rate: 0 <defaulted>

event-action: produce-alert <defaulted>

My problem is that we do not receive any alert. Is there a logical reason for this and if so what is it?

smahbub · ‎09-15-2006

This happens probably due to a corrupt image. Try reloading the IPS image from a backup

darin.marais · ‎09-15-2006

i think it is a bug in 5.x. TAC are working on a solution right now....

darin.marais · ‎09-15-2006

Let me say this again. It?s not a bug with the sensor as the alert is received. The problem is that the vms server does not pull the alert from the sensor database.

darin.marais · ‎09-26-2006

for those having the same problem.

quote:

Patch for CSCsg09932 - SecMon does not display any alert for sig6920

rate if it helps