Enterasys Intrusion Prevention System Manual page 196

6.x to 7.x Mappings
Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
BROADCAST
CHECK_NB
CHECK_NT
CHECK_RPC
A-2 Keywords/XML Attributes
7.0 XML Attribute
NSC/SC/C/NetworkLayer/Broadcast
NSC/SC/C/SMBAnalysis/log-netbios-session-failures
NSC/SC/C/SMBAnalysis/log-netbios-session-attempts
NSC/SC/C/SMBAnalysis/log-admin-login-attempts
NSC/SC/C/SMBAnalysis/log-null-login-attempts
NSC/SC/C/RPCAnalysis
Description
The Network Sensor can be configured to watch
for packets with strange broadcast destination
addresses. These packets are most likely denial
of service attacks, network probes or
malfunctioning routers. Broadcast has two
arguments. The first is the protocol (use 6 for
TCP, and 17 for UDP). A value of zero is a
wildcard. The second argument is the destination
IP address. This is a normal IP address without
any network bit mask. The Network Sensor
ignores internal broadcast traffic and
concentrates on traffic from non-protected
networks. Target addresses that end in .255 or .0
are common hacker probe values. Events of this
type are named BROADCAST.
• The maximum number of Broadcast rules allowed
is 7.
• A protocol value of 0 used as a wildcard.
Configures the Network Sensor to watch for certain
types of NETBIOS traffic. This setting is useful for
watching failed Windows file share mounting. These
mounting failures may be the result of a probe,
insufficient NT security resources, or legitimate users
mis-typing their NT domain password.
Valid Values:
• yes: enables
• no: disables
Configures the Network Sensor to look for a
variety of Windows NT logon events. This
variable is only for Windows NT, not Windows
2000 or XP.
Valid values:
• yes: enables
• no: disables
RPCAnalysis can be set as follows:
• verbose ( yes | no ) "no"
• any-port ( yes | no ) "no"
• inbound-only ( yes | no ) "no"
The above syntax means that each attribute can
have either the value "yes" or the value "no", and
each attribute defaults to the value "no".
The any-port attribute configures Network
Sensor to run the RPC decoder against all ports,
and the verbose attribute configured Network
Sensor to generate additional RPC decoder
output that is not normally displayed.