Enterasys Intrusion Prevention System Manual page 203

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
DRAGON_FILTER
(continued)
DROP_TTL
7.0 XML Attribute
NSC/SC/C/NetworkLayer/drop-ttl
Description
Any of these rules can be strung together to
make more complex rules. When piecing filter
statements together, the keywords and, or, and
not are used. These operators can also be
combined with nesting rules, which utilize
parentheses.
This filter rule is applied only to the FTP:USER-
ROOT event. Reading from left to right, one of
the IP addresses of each event must be from the
10.200.200.0/24 CIDR block and the source IP
address cannot be the 10.200.200.1 or
10.200.200.2 address.
Although these filters are very powerful, there
are some constraints to the filtering language.
There can currently only be one type of operator
on any level; other operators that are not nested
will produce unpredictable results. For example,
the following two filter statements show an
incorrect format with its correct format following.
Technical Note
s
• Do not wrap atomic items with () --> (net 10.0.0.0/
8).
• Individual filters can be commented out using either
# or ;.
• Technically, a period can precede any event name,
but it is intended for internal events.
• The maximum filter size is 5000 characters.
• Only one filter per event name.
• There is no upper limit for the number of filters. It is
designed so that every event can have a single
filter.
Network topology can be used against packet-
based IDS products. IP packets with low TTLs
may not make it to their destination. If the
Network Sensor is not aware of these topology
constraints, it might attempt to reassemble
packets that destination machines never even
see. Many other NIDS products do not consider
TTL when they reconstruct a network session.
There is no alerting with this action if
Deprecated is enabled, a message is printed to
STDOUT. If a Network Sensor is n hops in front
of a "NSC/SC/C/ProtectedNetwork" on
page A-35, the Network Sensor should ignore all
packets with a TTL of n-1.
Creating Network Sensor Policies and Signatures A-9
6.x to 7.x Mappings