Table of Contents
Advertisement
Configuring Port Macros
WEB-XSS-ATTACK
Signatures for Cross-Site Scripting (XSS) attacks are placed in this category.
Basic and Extended Signatures
The Enterasys IPS signature language was extended with the v7.2 release to include a number of
new features such as full Perl-compatible regular expression support, communication of state
information across signatures, per-signature thresholding, enhanced packet header tests, as well
as additional Network Layer, Transport Layer, and Application Layer properties. A new tab
containing the "Extended" signature properties was added to the Signature Property Settings
window, and a number of extended master signatures have been added to the Master Libraries.
However, the majority of master signatures remain "Basic" signatures.
Enterasys IPS firmware versions previous to v7.2 cannot use extended signatures, but they can use
basic signatures.
Configuring Port Macros
Port macros define complex ranges of ports, providing a simple way to apply a policy module or
signature across several ports or a complex range of ports. Port macros can be configured using
the Default Network Sensor Setting on the Network Policies tab in the Network Policy View. You
can then assign them by name in a Network Sensor module or signature.
Enterasys IPS provides a number of predefined macros, listed in
your own macros or add to or edit the existing macros.
Table 1-1 Pre-defined Macros
1-14 Network Sensor Overview
Note: If you want to change an existing basic signature with a basic pattern to an extended
signature, you must first remove the basic pattern(s), then create the extended pattern(s).
Macro
Description
W
web; search for traffic on ports 80, and 3128 and 8080 (common proxy ports)
B
not web; NOOP overflows, ignore port 80
U
compromise; search for UNIX keywords on ports 22, 53, 143,443, and 2049
N
compromise; search for NT keywords on ports 23, 53, 80, 135, and 139
X
X Windows; search for X Windows events on ports 6000 – 6070
H
high ports; search traffic above port 1023
L
low ports; search traffic equal to or below 1023
A
any ports; search traffic above port 0
M
net manage; search SNMP traffic to 161 and between 32771 – 32800 (RPC/Solaris)
Q
search traffic going to/ from ports in the range 27900 through 27999
R
rpc; search RPC traffic
S
ssh abuse; search for SSH servers not on port 22
T
telconvert; used by TELCONVERT to specify ports to decode telnet options
P
misuse; search FTP/web/NNTP for unwanted activities
Table
1-1. You can also define
Advertisement
Table of Contents
