Configuring Advanced Scanning - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
To view the DoS policies applied to a Sensor's interfaces, do the following:
1
Figure 173: DoS Detection Status
Tip:
Managing DoS Learning Mode profiles on a Sensor (on page 165).

Configuring advanced scanning

The
settings before configuration.
•
•
•
•
•
IPS Settings/Sensor_Name > IPS Sensor > DoS Detection Status
Select
follows:
DoS ID
: the port ID or sub-interface name.
Status
: lists whether the profile is currently learning or detecting. Learning means
the profile baseline is being built. Active means the learning profile has finished and
traffic is being checked against the baseline.
Transition Time
: the exact time when the learning profile started analysis or when
the detection for the learning profile began. The
is currently operating.
(Optional) Select an interface and click
the DoS profile applied to the selected interface. You can change the measure by
Select a Measure
toggling the
Back
Policy Detail" table, click
In the case of a failover pair Sensor the path to view the DoS policies is
Settings/Failover_Senosr_Name >DoS Management >DoS Detection Status.
For more information on how to restart or reload learning profiles, see
Advanced Scanning
tab contains actions that require a greater knowledge of network
Configuring non-standard ports (on page 164): Configure a protocol to be received by
a port it does not typically use.
Creating an interface group (on page 164): Enables multiple Sensor ports to be
grouped together for effective monitoring of asymmetric environments.
Managing DoS Learning Mode profiles on a Sensor (on page 165): Configure the DoS
learning mode profile to restart or load from a previous profile.
Managing DoS filters (on page 168): View and modify the "drop/block packets"
responses that have been initiated for the DoS Learning Mode profiles applied for all
network identifiers (NIs) within a Sensor.
Configuring TCP settings (on page 169): Customize Sensor TCP alerting parameters.
Status
View
to display rate data for the measures in
drop-down list and clicking
.
163
The IPS Sensor_Name node
. The fields are as
field indicates which process
View
. To return to the "Applied
IPS