About ball

ball · 02-02-2011

Is there any way to receive a notification (SNMP trap to Orion would be perfect), or collect some kind of report that tells the date/time a phone (specifically desktop IP phones, 7945/7965s) are unregistered/registered. We'd like to more proactively...

ball · 01-28-2003

On the IDS behind the firewall, I would like to create a filter to exclude all signatures that have a source address from my server's subnet (filter all supposed attacks coming from my servers). My questions is whether the IDS still capture alarms a...

ball · 12-17-2002

We have a resident student network, which coexists with the rest of the campus network. I want to keep the students behind the firewall (less likely that machines get comprimised) but I also want to keep them isolated from the rest of the internal f...

ball · 12-11-2002

I have a couple questions:1. If I go into IDM | Configuration | Sensing Engine | Filtered Signatures, and I want to filter out a whole class C network of destination IP addresses, should I just make an entry like: 192.168.1.0 for the whole network, o...

ball · 12-10-2002

I have 2 sensors in place, one sensor sees a mirror of the inside interface of the PIX and the other one uses a mirror of the uplink ports to the servers Cat6500 switch. All my servers are in one class C address range.In IEV, I get 2 alarms for ever...

ball · 07-29-2011

Per TAC: As you may be aware, Linux often has multiple ways to configure various functions. Products the Wireless Networking Business Unit makes that have a Linux operating system are designed to look at /etc/localtime for their timezone offsets, no...

ball · 02-02-2011

Thanks Luis - that error is exactly what I need to catch. I cannot seem to find where in RTMT I can get it to trigger an alert based on that error message. Do you know? Thanks again

ball · 01-28-2003

Yes, its cumulative.I noticed the same thing with the file size. I was running S35. I downloaded and installed the S39. While doing that, I checked the readme files for S37 and S38 for what new signatures were included. After the upgrade from S35...

ball · 12-17-2002

Mirror the port that comes from the inside or outside interface of the firewall. Then take a laptop, put it on the mirrored port, load the sniffing program of your choice, create a capture filter with this systems IP address, and let it begin collec...

Member Since	‎12-05-2002 08:31 AM
Date Last Visited	‎04-24-2024 12:05 AM
Posts	11

User Statistics

User Activity

Notification whenever a Phone goes unregistered?

Can I create a filter that will....

Designing the network for a DMZ (with VLANs)

Handful of questions relating to Signatures, IDM, and IEV

Creating a better filter

How to set or check time on the WCS?

Re: Notification whenever a Phone goes unregistered?

Re: 3.1-3-S39 cumulative?

Re: Easy way to log single ip address on PIX 515?