Enterasys Intrusion Prevention System Manual page 222

6.x to 7.x Mappings
Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
IP_OPTIONS
IPOPTS
LARGEICMP
A-28 Keywords/XML Attributes
7.0 XML Attribute
NSC/SC/C/NetworkLayer/LogOptions
NSC/SC/C/NetworkLayer/options-check
NSC/SC/C/ICMPAnalysis/large
Description
A variety of IP options can be recorded based on
option type and source IP. The Network Sensor
uses this to specify a list of rules that ignore or
record IP packets with options. Each rule has
three arguments. The first tells the Network
Sensor to log or ignore the specific option. To
log, use the letter L. To ignore, use the letter I. A
source IP network block is the second argument.
The third argument is the actual option. Use an
asterisk (*) as a wildcard for any IP option.
Events of this type are named [IP-OPTIONS]
which is also the same alert name given to
potential denial-of-service events specified with
"NSC/SC/C/NetworkLayer/options-check" on
page A-28.
Technical Notes
The maximum number of rules is 16.
For reference, some common IP option values:
Dec Binary Hex
0 00000000 0x00
1 00000001 0x01
7 00000111 0x07
68 01000100 0x44
130 10000010 0x82
131 10000011 0x83LOOSE_SOURCE_ROUTE
133 10000101 0x85
136 10001000 0x88
137 10001001 0x89
STRICT_SOURCE_ROUTE
148 10010100 0x94
Configures the Network Sensor to look for any
packets with IP options that have an option of
zero length or post EOL (End Of Line).
Note: There are non-compliant IP stacks in
existence that make a variety of violations in
normal everyday traffic. This means that this
setting will result in many false positives. If you
choose to use this setting, have Steven's "TCP/
IP Illustrated" handy. Some denial of service
attacks exist for network devices that simply
consist of post EOL IP options. These events are
labeled [IP-OPTS].
Used to log all ICMP packets that exceed a
certain size. Values of 1300, 1400 and even
1450 can be used to detect ICMP based denial
of service attacks and in some cases, hacker
backdoors that use ICMP as a transport protocol.
Accepts one argument, which is the size in
payload bytes that an ICMP packet needs to
exceed to cause an event.
Name
EOL
NOOP
RECORD
TIMESTAMP
BASIC_SECURITY
SECURITY
ID
ALERT