Enterasys Intrusion Prevention System Manual page 21

Logging Module
The Logging Module is one of the default and required modules that must be included in a
Network Sensor policy. This module defines where event logs are stored and how they are
displayed.
Network Layer Module
The Network Layer Module is one of the default and required modules that must be included in a
Network Sensor policy. This module defines what IP packet header fields the Network Sensor
should analyze and what actions the sensor should take when it finds certain anomalous values in
those fields (malformed headers, headers that don't match the relevant RFCs). You can also
configure certain fragment rebuilding parameters.
• IP packets can be logged or ignored based on IP option type and source IP address, or on IP
protocol and source address.
• Fragmented packets can be logged or ignored based on source address and protocol.
• Packets from a particular network or IP address can be logged.
• Packets with strange broadcast destination addresses can be logged. These packets are most
likely denial of service attacks, network probes, or malfunctioning routers.
Probe Detection Module
The parameters set with the Probe Detection Module configure the way the Network Sensor tracks
probing activities that cannot be detected by rule-matching or protocol anomaly detection. The
probe detection module builds vast internal tables to keep track of the following factors:
• Number of destination hosts
• Number of destination ports
• Number of source hosts
• Time over which the packets were sent
The module provides configuration settings that control how the sensor collects information and
generates events under certain situations:
• The options in the Probe Detection Settings area configure the thresholds used by the
Network Sensor when it performs port scan and port sweep analysis.
• The Port Ranges table is used to specify which port ranges you want the Network Sensor to
consider when analyzing for port scans and sweeps.
Creating Network Sensor Policies and Signatures 1-7
Network Sensor Policies