Enterasys Intrusion Prevention System Manual page 223

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
LOCALHOST
LOG_PS
LOKI
7.0 XML Attribute
NSC/SC/C/NetworkLayer/log-localhost-traffic
Deprecated
NSC/SC/C/CovertChannelAnalysis/loki-check
Description
Configures the Network Sensor to record any
packet with a source or destination address to or
from 127.0.0.0/8. This address space is
reserved. A variety of attacks choose their
source addresses from this block.
--For Ethernet only--
Because these packets are probably spoofed,
the hardware address is recorded for these
packets for further analysis. Keep in mind that if
a hacker has local layer 2 network access, they
can spoof the source hardware address.
However, if the attacker is remote, the hardware
address can tell you where the attack is coming
from on your network. There is also a good
chance that these events result from incorrectly
configured routers. In this case, the hardware
address is also useful in debugging these
problems.
Many tools that use IP source address spoofing
that choose from the range of 0.0.0.0 to
255.255.255.255 have a one in 256 chance of
choosing an address in the 127.0.0.0/8 range.
Tools like NMAP have this problem when they
spoof decoy packets.
These events are labeled [LOCALHOST].
Configures the Enterasys IPS Sensor to specify
when it evaluates the collected set of distinct
packets. It records this event to the 'dragon.sys'
file. Analysis of these events can help measure
the overall impact on the Enterasys IPS Sensor
performance. The total time of evaluation is
recorded. Users should consider how long the
port scan analysis is taking and how often. When
the Enterasys IPS Sensor is performing the
analysis, the system is still collecting network
packets, but there are fewer CPU cycles to
complete this task.
Loki is a tool used to communicate between a
client and a server using ICMP. Tools such as
this are commonly used by hackers as covert
channels to access systems they have broken
into. By specifying this keyword, the Network
Sensor will search ICMP echo and echo request
packets for trivial evidence of Loki traffic.
Creating Network Sensor Policies and Signatures A-29
6.x to 7.x Mappings