Detecting Intrusions - Polycom RealPresence Group Series Administrator's Manual

Related Links
Port Lockout on page 93
Secure API Access on page 92
Restrict Access to User and Administrative Settings
You can restrict access to User Settings and Administration settings in the RealPresence Group Series
system local interface, making them available only through the system web interface.
Procedure
1. In Admin Settings > General Settings > Home Screen Settings > Home Screen Icons, disable
the Show Icons on the Home Screen setting.
2. Click Save.
If the following conditions are met, the ability to show icons is automatically enabled and read only:
• Speed Dial is disabled in the Admin Settings > General Settings > Home Screen Settings.
• The Calendar is not displayed because the system is not connected to the Microsoft Exchange
Server.
• Remote access through the web, telnet, and SNMP are disabled in Security > Global Security >
Access.

Detecting Intrusions

When the RealPresence Group Series system detects a possible network intrusion, it logs an entry to the
security log. This logging is controlled by the Enable Network Intrusion Detection System (NIDS)
setting. The security log prefix identifies the type of packet detected, as shown in the following table.
Prefix
SECURITY: NIDS/unknown_tcp
SECURITY: NIDS/unknown_udp
SECURITY: NIDS/invalid_tcp
SECURITY: NIDS/invalid_icmp
SECURITY: NIDS/unknown
SECURITY: NIDS/flood
Following the message prefix, the security log entry includes the timestamp and the IP, TCP, UDP, ICMP,
or ICMPv6 headers. For example, the following security log entry shows an "unknown_udp" intrusion:
2009-05-08 21:32:52 WARNING kernel: SECURITY: NIDS/unknown_udp IN=eth0
Polycom, Inc.
Packet Type
Packet that attempts to connect or probe a closed TCP
port
Packet that probes a closed UDP port
TCP packet in an invalid state
ICMP or ICMPv6 packet in an invalid state
Packet with an unknown protocol number in the IP
header
Stream of ICMP or ICMPv6 ping requests or TCP
connections to an opened TCP port
Securing the System
91