About twiggles

twiggles · 07-26-2017

Hi, I'm a little taken aback at how difficult this is and I'm wondering if I'm missing something right under my nose. I set up several IP SLAs to monitor RTT on our WAN links and they work fine ... if you log in and type "show ip sla statistics." W...

twiggles · 02-07-2003

I come from Snort IDS so pardon my confusion. I have been asked by my boss(es) to trim down the number of alerts we are seeing by culling false positives and perhaps adjusting thresholds. My problem is simply that my first step in determining the v...

twiggles · 12-03-2002

Hello all, as part of normal IDS alert investigations we're looking for a sniffer to complement the Netranger. I realize that this is a little bit off-topic so if anyone wants to respond privately that is fine (twigles at yahoo dt com). Basically s...

twiggles · 11-04-2002

Hey all, before I start writing a script to roll alerts into syslog I figured I'd make sure the box (4230) could syslog to my server. I changed /etc/syslog.conf to include the line:local0,local1,local2,local3.debug @loghostThis started...

twiggles · 09-19-2002

Hello all, I'm trying to figure out where someone plugged our sensor's monitoring interface in so I can span the port. Unfortunately no one described the interface and I can't find any docs with that info. So I figured I could grab the MAC address ...

twiggles · 01-17-2018

I agree with George. Port security is, IMO, a clumsier method of solving the same problem. Not only can you filter on the same mechanism in ISE (MAC address), you can filter on things like CDP and SNMP data now, or certificates. By implementing tw...

twiggles · 07-27-2017

Ok I yanked it all out and put back the least lines possible to make sure I understand exactly what's happening here, and your post was correct - the "threshold 5" was not needed. The reason I wasn't triggering events was the order of commands entere...

twiggles · 07-27-2017

Spoke too soon, as is usually the case. I replicated SLA23's configuration as SLA24, and only added "threshold 5" so anything over 5ms as a response would trigger it and I got an immediate syslog message. I'm honestly confused as he-double-hockeyst...

twiggles · 07-27-2017

Thanks Francesco. Unfortunately it's still sitting there silently being "over threshold." I left SLA 22 as it was and put yours in as IP SLA 23 so I could compare the differences and they look almost the same in the show outputs. They're both doing...

twiggles · 05-03-2017

This is really pissing me off to the point that I'll recommend other solutions moving forward.

Member Since	‎12-06-2001 10:57 AM
Date Last Visited	‎08-15-2018 02:19 AM
Posts	41
Total Helpful Votes Received	16

User Statistics

User Activity

Using EEM to generate a syslog message via IP SLA for high RTT

Investigating alerts for false positives

Netranger + NAM = IDS/troubleshooting?

syslog sending alerts to UDP 515?

ifconfig -a doesn't show the second interface?

Re: ISE Switch Setup with Port Security

Ok I yanked it all out and

Spoke too soon, as is usually

Thanks Francesco.

This is really pissing me off