hi macabal
here is some info and i will mail you the report directly and what next should i uninstall the s22 and install the new 3.1 s23 ?
thanks for your helps
philippe
------------------
# cidServer version
cidwebserver v33 (Release) 02/04/26-01:32
cidwebserver (241) is running.
# sysconfig-sensor
Cisco IDS Sensor Initial Configuration Utility
Select options 1 through 6 to initially configure the Sensor.
1 - IP Address
2 - IP Netmask
3 - IP Host Name
4 - Default Route
5 - Access Control List
6 - Communications Infrastructure
7 - Date/Time and Time Zone
8 - Passwords
9 - Secure Communications
10 - Display
11 - IDS Device Manager
x - Exit
Selection: 11
IDS Device Manager
Current Mode: Enabled
1 - Disable
x - Exit
Selection: x
Cisco IDS Sensor Initial Configuration Utility
Select options 1 through 6 to initially configure the Sensor.
1 - IP Address
2 - IP Netmask
3 - IP Host Name
4 - Default Route
5 - Access Control List
6 - Communications Infrastructure
7 - Date/Time and Time Zone
8 - Passwords
9 - Secure Communications
10 - Display
11 - IDS Device Manager
x - Exit
Selection: x
sysconfig-sensor has completed successfully.
*********************************************************************
For the most effective security, please download and apply the latest
signature updates from the Software Center at http://www.cisco.com
*********************************************************************
#
# ^[[A^[[A^H
^[[A^[[A^H: not found
# sysconfig-sensor
Cisco IDS Sensor Initial Configuration Utility
Select options 1 through 6 to initially configure the Sensor.
1 - IP Address
2 - IP Netmask
3 - IP Host Name
4 - Default Route
5 - Access Control List
6 - Communications Infrastructure
7 - Date/Time and Time Zone
8 - Passwords
9 - Secure Communications
10 - Display
11 - IDS Device Manager
x - Exit
Selection: 5
Access Control List
You can modify the list of IP addresses and networks that are allowed to log
into the Sensor. A TCP wrapper application enforces this list. If a host with
an IP address that is not in this list attempts to log into the Sensor, the
TCP connection will automatically be closed.
WARNING: If you have changed the IP address of the Sensor, list the host
addresses from which you log in remotely.
This list must contain only host IP addresses and not host names. The Sensor
by default does not use ANY type of name service (for example, DNS, NIS, NIS+).
List the network addresses with just the network portion of the address. For
example: 192.9.200.
Current list:
10.
Enter an address to add to the list. If the address entered is already in
the list, it will be deleted from it.
IP address::
Cisco IDS Sensor Initial Configuration Utility
Select options 1 through 6 to initially configure the Sensor.
1 - IP Address
2 - IP Netmask
3 - IP Host Name
4 - Default Route
5 - Access Control List
6 - Communications Infrastructure
7 - Date/Time and Time Zone
8 - Passwords
9 - Secure Communications
10 - Display
11 - IDS Device Manager
x - Exit
Selection: x
sysconfig-sensor has completed successfully.
*********************************************************************
For the most effective security, please download and apply the latest
signature updates from the Software Center at http://www.cisco.com
*********************************************************************
#
# snoop -d iprb0 10.172.32.231 10.172.32.108 port 80
Using device /dev/iprb (promiscuous mode)
10.172.32.108 -> bobst HTTP C port=1237
bobst -> 10.172.32.108 HTTP R port=1237
10.172.32.108 -> bobst HTTP C port=1237
bobst -> 10.172.32.108 HTTP R port=1237
10.172.32.108 -> bobst HTTP C port=1237
bobst -> 10.172.32.108 HTTP R port=1237
10.172.32.108 -> bobst HTTP C port=1243
bobst -> 10.172.32.108 HTTP R port=1243
10.172.32.108 -> bobst HTTP C port=1243
bobst -> 10.172.32.108 HTTP R port=1243
10.172.32.108 -> bobst HTTP C port=1243
bobst -> 10.172.32.108 HTTP R port=1243
^C# cidServer stop
Stopping cidwebserver... 241 terminated.
# cd /usr/nr/idsRoot/etc
# cp cidwebserver.conf cidwebserver.conf.bka1
# vi cidwebserver.conf
Cisco IDS 3.1 configuration file
docRootPath=htdocs
servlets=idm
ports=80
connectionsPerPort=20
timeoutForRequestInSeconds=60
timeoutForRequestWithKeepAliveInSeconds=120
numberOfRequestsToProcessWhileKeepAliveActive=250
maxContentLength=16384
tlsEnabled=1
provideStats=0
allowIdm=1
idmServletName=idm
[FileExtensions]
html = text/html
htm = text/html
gif = image/gif
jpeg = image/jpeg
jpg = image/jpeg
jpe = image/jpeg
:q!
# cidServer start
Settings match current configuration...no need to update.
Checking for certificates...certificates found.
Starting cidwebserver... Error: cidwebserver (241) is already running.
# cat /usr/nr/sp-update/output.log
cat: cannot open /usr/nr/sp-update/output.log
# run /usr/nr/idsRoot/bin/cidDump
run: not found
# ./usr/nr/idsRoot/bin/cidDump
./usr/nr/idsRoot/bin/cidDump: not found
# cd /usr/nr/idsRoot
# ls
bin etc htdocs log tmp var
# cd bin
# ls
cidDump cidServer cidwebserver fingerprint selfcert
# ./cidDump
Generating report ..............................................................
.................Done
# ls
cidDump cidServer cidwebserver fingerprint selfcert
# cd ..
# ls
bin etc htdocs log tmp var
# cd htdocs
# ls
cgi-bin private protected public
# cd private
# ls
auth cidDump.html
# ls -al
total 678
drwxr-x--- 3 netrangr netrangr 512 May 16 19:21 .
drwxr-x--- 6 netrangr netrangr 512 May 15 19:37 ..
drwxr-x--- 2 netrangr netrangr 512 May 15 19:38 auth
-rw-r--r-- 1 root other 332476 May 21 14:08 cidDump.html
# date
Tue May 21 14:09:30 GMT 2002
# exit
