I have an internel and an external sensor. Both sensors are picking up Netsky virus activity from the same external address. My outside sensor is setup to shun those addresses. Should't that prevent any signatures from passing through the firewall?

I recieve several 1104 Local host signatures on my outside sensor, what is the best defense for this?

I upgraded to 4.1-3-S61 and am now getting several rf poison signatures throught the internal network. Does anybody know what process might trigger this alert and how to filter it other than disabling the sig?

I have a 2610 router as my gateway. I want to block and ip range from passing through. I have been under a constant flow of MSSQL Command sig's and want to block the entire 61.0.0.0 network. What is the syntax for the access list. I have "access-list...

I have recently installed a 4235 sensor. I am not getting any activity on the siffer port. I have moved the cables around but still have no luck. How do I edit the packetd.conf file to make sure the settings are correct?