Enterasys Intrusion Prevention System Manual page 22

Network Sensor Policies
Protocol Analysis Module
The Protocol Analysis Module allows you to configure the Network Sensor to perform analysis on
a variety of protocols. Basically, this module checks whether packets meet the requirements of the
relevant protocol RFCs.
The protocols that can be analyzed include:
• DNS
• FTP
• Finger
• H.225 and H.245
• HTTP
• ICMP
• MGCP
SNMP Trap Module
The SNMP Trap Module configures the parameters used by the Network Sensor when it sends
SNMP traps to SNMP servers. When the sensor creates an SNMP trap, it can select a particular IP
address to show up in the SNMP record. This IP address can be different from the interface from
which the sensor sends the SNMP traps, which is useful if a particular IP address is required for
recognition.
TCP State Module
TCP State Module is a connection tracking mechanism that Enterasys IPS uses to flag packets that
are not part of an established TCP session. This is particularly effective against certain attacks like
"stick" and "snot" that use multiple acknowledgement packets that are not part of a session.
Some additional filtering is also applied to UDP and ICMP (for example, an orphaned ICMP port
unreachable message), but because these are connectionless protocols, the most comprehensive
connection filtering capability is for TCP.
Transport Layer Module
The Transport Layer Module is one of the default and required modules that must be included in a
Network Sensor policy. This module contains 10 tabs for configuring Transport Layer logging and
event generation options.
• The General Settings tab allows you to tell the sensor to:
–
–
–
1-8 Network Sensor Overview
Log any TCP or UDP packet with a source or destination port of zero. Such packets may
be the result of NAT devices, busy DNS servers, and a variety of hacker scanning and
probing attacks.
Verify the integrity of inbound TCP packets by calculating their checksum and comparing
it to the value in the packet. If a discrepancy is discovered, the packet is dropped. You can
also log such events.
Analyze all of the data in captured SYN packets for non-zero bytes and generate an event
when such packets are identified.
• RIP
• RPC
• SIP
• SMB
• SNMP
• Telnet