Enterasys Intrusion Prevention System Manual page 19

Application Filter Module
This module defines traffic criteria that can be ignored by the sensor. Use this module to refine the
data which the sensor analyzes, by telling the sensor what types of traffic and packets to ignore.
By reducing the amount of data that the sensor has to look at, and therefore the number of events
generated, you can often improve the performance of the sensor as well as the analysis process.
Application filters are applied before any inspection of data occurs. Therefore, if a filter is
matched, the sensor does not do any further processing of the data — that is what is meant by
saying that the data is "ignored." In general, if you know of a particular class of traffic that can be
ignored (for example, from a particular IP address or VLAN), then you should use a filter, since
this will generally lessen the load on the sensor.
You can tell the sensor to ignore traffic based on the following criteria:
• Direction with Respect to the Sensor's Protected Network, set using the General Settings tab.
• IP Address and Direction, set using the IP Settings tab.
• TCP and UDP Port Number and Direction, set using the Port Settings tab.
• IP Protocol Number, set in the Protocol Settings tab.
• Specific VLAN or range of VLAN numbers, set in the VLAN Settings tab.
• Traffic That Looks Like a Port Scan or Port Sweep, set using the Probe Settings tab.
• IP Address, Port, and Protocol Rule combinations, set in the Rule Settings tab.
• Signatures, set using the Signature Settings tab.
Covert Channel Analysis Module
Many hackers use ICMP echo request and echo reply packets to communicate covertly.
Specialized ICMP client and servers such as Back Orifice 2000 and LOKI are good examples. The
Covert Channel Analysis module provides parameters to configure three types of analysis:
• Backdoor Settings, which enable discovery of streams of unsolicited ICMP replies or ICMP
streams with static sequence numbers.
• Fast ICMP Settings, which also catch backdoors that utilize ICMP.
• Enable Loki Check Setting, which catches Loki traffic.
DoS Check Module
This module allows you to add Denial of Service checking to a Network Sensor policy. When
Denial of Service checking is enabled, the Network Sensor searches packets for distinct
trademarks of specific denial of service tools that are in use and freely available. The sensor will
generate different DoS internal events, depending on the tool. If a Denial of Service attack is
observed, the event data will contain the attack information.
Creating Network Sensor Policies and Signatures 1-5
Network Sensor Policies