Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual page 416

Troubleshooting the 4200 Series Appliance
Step 3 Make sure the correct alarms are being generated:
sensor# show events
evAlert: eventId=1047575239898467370 severity=medium
originator:
hostId: sj_4250_40
appName: sensorApp
appInstanceId: 1004
signature: sigId=20000 sigName=STRING.TCP subSigId=0 version=Unknown
addr: locality=OUT 172.16.171.19
port: 32771
victim:
addr: locality=OUT 172.16.171.13 port: 23
actions:
tcpResetSent: true
Make sure the switch is allowing incoming TCP reset packet from the sensor.
Step 4
Refer to your switch documentation for the procedure.
Step 5 Make sure the resets are being sent:
root# ./tcpdump -i eth0 src host 172.16.171.19
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: listening on eth0
13:58:03.823929 172.16.171.19.32770 > 172.16.171.13.telnet: R 79:79(0)
ack 62 win 0
13:58:03.823930 172.16.171.19.32770 > 172.16.171.13.telnet: R 80:80(0)
ack 62 win 0
13:58:03.823930 172.16.171.19.32770 > 172.16.171.13.telnet: R 80:80(0)
ack 62 win 0
13:58:03.823930 172.16.171.19.32770 > 172.16.171.13.telnet: R 80:80(0)
ack 62 win 0
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
B-38
SIGID: 20000 <protected>
SubSig: 0 <defaulted>
AlarmDelayTimer:
AlarmInterval:
AlarmSeverity: medium <defaulted>
AlarmThrottle: Summarize <defaulted>
AlarmTraits:
CapturePacket: False <defaulted>
ChokeThreshold:
Direction: toService <defaulted>
Enabled: True <defaulted>
EventAction: reset
Appendix B Troubleshooting
78-15597-02