About meether

meether · 11-27-2003

Hi,I have an IDS 4210 4.1. In the event viewer alarms 1202, 1204 and 1208 fires with 83.0.0.0 as source ip adress and 0.0.0.57 as destination I don't understand why my IDS see this IP ?Can someone could help me please ?Thanks

meether · 09-30-2003

Hello, I can't modify action for some alarms from "ZERO" to "Shunhost" ex: alarm 3216 (www directory traversal ../..).I try with alarm 3215 (iis dot dot execute bug) and it's ok.I don't understand why.Could someone help me please ?Regards Eric

meether · 09-11-2003

Hello,Since I have installed the S50 Signature Update for Cisco IDS v.4.1 on my IDS 4210, the alarm 995/1 fires at least twice a day. So I must reset my IDS. Generally, alarms 3215 (iis dot dot execute bug), 3216 (www directory traversal ../..), 5081...

meether · 07-25-2003

Hello,If I modify the action of the signature 4701 (MSSQL Control Overflow) from "ZERO" to "reset/shunhost", I don't see any host in the host manual blocks panel.If I choose "shunhost", it's ok.I don't understand why. With others signatures pre-defin...

meether · 07-23-2003

Hello,I am working with IDS Device Manager 4.0 and IDS 4210.In "Signature Configuration Mode" --> "Event Action", what is the difference between "ZERO" and no choice ?Thanks

meether · 12-04-2003

We use IEV 4.1.1 S59 with windows 2000 server SP4.It works fine.Eric

meether · 12-02-2003

I use "iplog 0 83.0.0.0" and "iplog 0 0.0.0.57" .Alarms were fired by a windows XP computer with NWLink client installed on. It did a "local master annoucement".ThanksEric

meether · 11-27-2003

Hi,I would like to change event action from anything to reset AND shunhost with CLI.How can I do this ?RegardsEric

meether · 10-07-2003

when an ip is shunned in my IDM, it is not in the pix. So I reset the ssh key between pix and 4210.Now when alarms 3215 (iis dot dot execute bug), 3216 (www directory traversal ../..), 5081 (www winnt cmd.exe access), 5114 (www iis unicode attack), 5...

meether · 10-02-2003

Before the S50 signature update, 4210 was out of the Lan and I never had any problem.Since I have installed the S50 signature update, 4210 is linked to a hub between firewall and a packetshaper. But I must reset my 4210. The eventAction for alarms 32...

Member Since	‎07-21-2003 01:55 AM
Date Last Visited	‎08-18-2017 03:50 AM
Posts	13

User Statistics

User Activity

Action 1202, 1204 and 1208 from 83.0.0.0

Modify action from "ZERO" to "Shunhost"

Alarm 995/1

Event Action : Reset/Shunhost pb

IDSDM V4.0 Configuration of a signature

Re: Can't Install IDS Event Viewer

Re: Action 1202, 1204 and 1208 from 83.0.0.0

Re: Modify action from "ZERO" to "Shunhost"

Re: Alarm 995/1

Re: Alarm 995/1