When configuring each signature there is an action that can be assigned to each signature:
Block/Shun - creation of ACLs on routers and firewalls to block the ip
TCP Reset - sending of tcp reset packets to shutdown the connection
IP Log - capturing the packets from the source address in a binary format
Combinations - any combination of the above actions
So to turn on TCP Resets you just need to configure certain signatures to have an action of TCP Resets.
Other things you should know:
1) The IDS Module does not support TCP Resets
2) The TCP Resets will be sent out the sniffing interface of the sensor.
3) If the sensor is connected to a span port of the switch, the switch may block the TCP Reset from being sent out. This is a switch issue, and not a sensor issue. Some switches allow it by default, some have it as a configurable option (inpkts enable) and others never allow it. You will need to read on your particular switch to determine if it will allow in the TCP Resets.
4) I have heard that some firewalls may block the TCP Resets, but I don't have any specifics.
Marco
