About mjuckett

mjuckett · 10-04-2005

Twice in two weeks the Event Viewer has quit showing alerts. It takes restarting the services from CW to have events start showing up again. Looking through the logs on the server, I found one log file with errors at the corresponding times for whe...

mjuckett · 09-16-2004

Good morning, I have been asked by management to create a signature that will detect all traffic from a particular IP on our network. This is how I tried to set it up:String.tcp engineServicePorts: 1-65535 (Yes I realize this will cause a signifi...

mjuckett · 11-17-2003

I am trying to view the list of signatures that were disabled in the S61 upgrade. The bugid we are given is CSCec88388. I keep getting told that it doesn't find that id. Can someone verify if this is the correct ID or link directly to that bug ple...

mjuckett · 10-20-2003

Is anyone else having trouble getting into the Cisco FTP server? Once it reaches that point and prompts me for a username and password I get an error that Internet Explorer cannot open that site.I have tried ftping to the ftp.cisco server and can ge...

mjuckett · 09-30-2003

I updated my 4235 today with 3.1(4)S53 and S54 through VMS. I didn't watch VMS closely between updates so I'm not sure which update did it; I just verified on the sensor that S53 was installed and then pushed out S54. In VMS that sensor lost it...

mjuckett · 09-22-2004

That worked great. Thank you so much.MJ

mjuckett · 09-16-2004

Thank you very much. I have pushed that out to the needed sensor. Now I just have to wait for the user to return to work to test it.Thanks again,MJ

mjuckett · 06-11-2004

Good grief! How quickly can y'all get a patch to fix this? VMS pushed out the S96 signature pack to our sensors and while VMS shows the correct config, the sensors turned on all alarms. Pushing out a configuration file from VMS to each sensor seem...

mjuckett · 05-27-2004

I am seeing this traffic as well. I am seeing about 150 attempts a day from the internet to our firewall. The signatures that I see fire are 1204-No Initial Frag and 1208-Incomplete Datagram, source and dest port 16191. This is seen by a 4235 runn...

mjuckett · 05-03-2004

Thanks very much for the update. I can see the files out there now for download and will download them as soon as synching allows.

Member Since	‎04-26-2001 09:38 AM
Date Last Visited	‎08-18-2017 03:50 AM
Posts	51
Total Helpful Votes Received	4

User Statistics

User Activity

VMS IDS receiver failing silently

Need help creating a custom signature please

Unable to find bugid listed in S61 readme

Unable to download S57

VMS lost signatures upon sig update

Re: Need help creating a custom signature please

Re: Need help creating a custom signature please

Re: Problems with IDS signature update S96

Re: IP Fragments and "port 16191"

Re: Sig 3338 for LSASS not detecting SASSER