Traffic Management - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
5
Note that when you enable IP spoofing detection, a Sensor drops any IP-spoofed packets
but raises no alert. You can view the number of IP-spoofed packets dropped by the Sensor
by creating a dashboard in the Real-time Threat Analyzer.
To create a dashboard and view the count of IP-spoofed packets dropped by the Sensor:
1
2
3
4
5
6
7
Figure 195: Dashboard for anti IP spoofing
Note 1:
latest information.
Note 2:
the amount of traffic being monitored by the selected port, the counters may not
reset completely to zero. This is due to the amount of time it takes for the reset
request to be sent from the Manager to the Sensor and back. Traffic monitored
during that time will produce a value greater than zero.
Alternatively, you can also use the show inlinepktdropstats CLI command to view
the number of IP-spoofed packets dropped by a Sensor. For information on using this CLI,
refer to the

Traffic Management

Traffic management techniques help in avoiding traffic congestions, controlling the actual
traffic flow within the permissible limit of the network, and using queues to limit traffic
surges in the network.
Commit Changes
Click to enable IP spoofing detection; click
Commit Changes
Once you select
thus, you do not have to execute an
Launch the Real-time Threat Analyzer from the Manager home page.
The Summary page opens.
Options > Dashboard > New
Click
Enter a name for the dashboard and click
No space or special characters are allowed in the Dashboard Name.
Assign Monitor
Click .
In the Assign Monitor dialog, select Default Monitors as the
Type
Performance as the , and Statistics – IP Spoofing as the
OK
Click .
In the Dashboard that you created, select the Sensor and the In-line port pair for
which you have enabled anti-spoofing.
Count
The displays the number of IP-spoofed packets dropped at port-pair. If Disabled
Count
is displayed under , it means that anti-spoofing is not enabled for that port-pair.
Ports
Note that lists only the In-line port-pairs.
The dashboard is not updated in real-time. So, click
Reset Counters
You can click
Sensor CLI Guide
.
, the configuration is sent via SNMP to the Sensor;
Update Configuration
.
OK
.
to reset all data to zero. However, depending on
190
The IPS Sensor_Name node
Ignore Changes
to abort.
for the Sensor.
Category
, Sensor
Monitor
.
Refresh
to the see the