Enterasys Intrusion Prevention System Manual page 132

Configuring the Transport Layer Module
Procedure
To configure Log Start/Stop settings:
1. Click the Network Policy View icon and the Network Policies tab.
2. Expand the tree by clicking the expansion symbols and select the desired custom policy name.
The modules for that policy are displayed in the tree.
3. Click the Transport Layer Module in the tree.
4. Click the Log Start Stop tab.
5. Click Add to add a new rule. The Transport Layer Log Start Stop dialog box is displayed.
6. Select the desired Action, either log or ignore.
7. Enter the destination IP address or CIDR block for the rule using the following format:
<IP address>/<mask>
Select the appropriate IP version checkbox. Network masks can range from 0-32 for IPv4 and
0-128 for IPv6.
8. Enter the port number. Refer to
as a wildcard meaning any port.
9. If you want the sensor to dynamically log additional packets when the logging rule being
configured is hit, enter the number of packets to log in the Dynamic field. The maximum
value is 65535.
10. Click OK. The rule is displayed in the table.
11. Click Edit or Delete to change or delete existing rules.
12. Use the Move Up and Move Down buttons to place the rules in the desired order.
13. Click Commit to add your changes to the policy being configured.
2-102 Creating Network Sensor Policies
Table 2-1 on page 2-8 for a list of common port numbers. Use 0