Table of Contents
Advertisement
This chapter provides an overview of Network Sensor operation and explains what network
sensor policies and signatures are. This chapter also includes information about configuring port
macros, which can be used in network sensor policies and signatures.
For information about...
Enterasys IPS Network Sensors
Network Sensor Policies
Network Sensor Signatures
Configuring Port Macros
Enterasys IPS Network Sensors
The Enterasys IPS Network Sensor is a packet-based Network Intrusion Detection System (NIDS)
and response system. It collects network packets and analyzes them for a variety of suspicious
activities. Suspicious activity may indicate network abuse, probes, intrusions, or vulnerabilities.
The Network Sensor also monitors network packets for computer criminals, hackers, employee
misuse, and network anomalies. Multiple Network Sensors can operate jointly to provide
enterprise coverage of complex networks that are managed by the Enterprise Management Server
(EMS). Network Sensor can send pages and email alerts when it detects suspicious events while
taking action to stop the event and record the event for future forensic analysis. It can take action
to shut down the connection to avoid further damage.
Network Sensors typically are deployed at network aggregation points and ensure the validity of
traffic in layers two, three, and four. The sensors can reassemble fragmented frames and
reconstruct TCP and UDP streams to counteract detection evasion tools. Network Sensors use
signature-based pattern matching, protocol analysis and decoding, and anomaly detection
techniques.
When an attack is detected, Network Sensor employs a variety of active response techniques to
block the would-be intruder, including taking action to stop the sessions and reconfiguring
firewall policies or switch and router Access Control Lists. Network Sensor offers deep forensic
capabilities, including flexible packet capture and complete session information (such as
information about HTTP, FTP, POP, and certain IPs or networks) needed to analyze network-based
attacks.
Network Sensor Overview
Creating Network Sensor Policies and Signatures 1-1
1
Refer to page...
1-1
1-2
1-9
1-14
Advertisement
Table of Contents
