Enterasys Intrusion Prevention System Manual page 171

5. Destination Port: Enter the destination port or ports to match.
– To specify a single port, select Port and enter the port number. Refer to
page 2-8 for a list of common port numbers. Valid values range from 0 to 65536.
– To specify multiple ports or port ranges, select Port Macro and then select the desired
macro from the pull-down menu. Refer to
more information.
– Select Match Negative if you want the signature to match if the port is not the value
specified. For example, if you selected the pre-defined port macro W, which specifies
ports 80, 8080, and 3128, and then selected Match Negative, the signature would apply to
all ports except 80, 8080, and 3128.
6. Event Limit: Sets a limit on the number of times a signature must match against network
traffic before an event is generated. See
information.
– Set Hard Limit to Yes to set the number of times a signature match must occur before an
event is generated, regardless of the time period involved.
– Set Threshold Limit to Yes to set the number of times a signature match must occur
within a specified period of time before an event is generated.
– If you set Threshold Limit to Yes, specify the period of time in which the number of
signature matches must occur in the Interval (secs) field. Valid values range from 10 to
8,400 seconds.
– In the Apply To field, select:
- Source if the signature matches must all be from the same source.
- Destination if the signature matches must all be directed to the same destination.
– In the Number of Alerts field, specify the number of signature matches that must occur
before an event is generated. Valid values range from 1 to 4,294,967,296.
7. If desired, configure a Flow Tag. Refer to
page 3-21 for a description of flow tags.
a. Click New to add a flow tag. The Flow Tag Editor window appears.
b. Enter the Tag value. You can enter any meaningful text string.
"Configuring Port
"Setting Event Limits" on page 3-23 for more
"Communicating State with Flow
Creating Network Sensor Policies and Signatures 3-29
Creating Custom Signatures
Table 2-1 on
Macros" on page 1-14 for
Tags" on