Enabling Ip Address Spoofing Detection - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
4
5

Enabling IP Address spoofing detection

The
external to your network (inbound) that use your internal addresses as the source IP
addresses, or those packets that originate from your internal network (outbound) which
use IP addresses not defined in your customized list of "good" addresses. You can apply
IP address spoofing detection to interfaces that are segmented by CIDR-based
addressing. A Sensor maintains a table of CIDR-based addresses it protects. Then, for
example, if it detects a packet that originated from outside your network but contains an
identified internal address, it just drops the packet.
Threshold settings
:
Option
Suppression interval
Maximum logs per suppression
interval
Maximum summary logs per
suppression interval
Commit Changes
Click .
Anti-spoofing
action enables the detection of packets that either originate from sources
The time span in which you accumulate
instances of the same attack. This value
acts as a timer; when the timer expires, the
current instance is cleared to make room for
a new suppression instance.
Identifies the minimum number of alerts that
must be detected for a unique suppression
instance to be classified as an attack. This
number means you "accept" a specific
number (x) of the same attack. Thus, if you
detect x-1 by the expiration of the interval
(Suppress for [X] seconds field), alerts are
sent for each separate occurrence and there
is no Exploit throttle. If there are x+1, the
first x attacks are sent as individual alerts
and the attacks exceeding this count are
throttled into one alert that summarizes this
persistent attack. By sending a few of the
throttled alerts as individuals allows you to
view details and packet log information for
the first few instances of an attack.
Determines the number of unique
suppression instances to maintain at a given
time. For example, if you enter the number
10, then 10 unique instances can be tracked
at a given time. Once 10 is reached, all
other cases are kept in a single "wildcard"
instance; thus, other unique combinations
that occur outside of the 10 uniquely
maintained instances are maintained as one
instance, and source and destination IP do
not appear in the summary since multiple
addresses may be involved. An entry is
removed after the time limit (Suppress for
[X] seconds) has expired.
188
The IPS Sensor_Name node
Description