port scan signatures

[alkabeer80]

Hi,

I have IPS 4270, is there signature for port scanning, so that it fires when any user run the scan (angry port scan, etc.....), if not can i creat a signature for this, how ???

thankssss                   

[Andrew Phirsov]

I think the sweep engine and signatures related to it are responsible for what you want to achieve.

"How???" 

Have you tried to read cisco guide on how to configure IPS and how it works? I think it's the best way to find out.

[Julio Carvajal]

Hello Alkabeer,

Ofcourse there are Check the Dos categories.

You could also use the anomaly detection feature that will allow you to set a base-line in your network to determine what is normal and what is not.

Regards,

Jcarvaja

[AdamBlackNNT]

I believe there is a whole category called "reconnaisance" devoted to things like that.  You should be able to go in and verify that the signature that matches the type of scan you're looking for is enabled and, if not, enable it.  If it doesn't exist you can probably copy an existing rule and tweak it for your needs with minimal effort.