Enterasys Intrusion Prevention System Manual page 225

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
NAME
NULL_IP
PAIRS
7.0 XML Attribute
NSC/SC/name
NSC/SC/C/NetworkLayer/null-address
NSC/SC/C/TransportLayer/LogPairs
Description
Specifies the name of a particular Enterasys IPS
Sensor. A name must be specified in each
dragon.net configuration file, or the Enterasys
IPS Sensor will exit. This name is used to identify
entries in log files. The name can be any
combination of characters without white spaces.
When using an Enterasys IPS Policy Manager
the name of the Sensor is very important, as it
identifies which Enterasys IPS Sensor detected
each recorded event.
Technical Note
To reduce hard drive space, consider using short
names such as `nids1` or `ids10`.
Any IP packets with a source or destination
address of 0.0.0.0 should be considered
suspicious. Many unsophisticated network
scanning programs will use an IP address of
0.0.0.0 during scanning. Packets to or from
0.0.0.0 and also to or from 255.255.255.255 are
ignored by default. This is because many layer
two RPC and multicast protocols place these
packets on local Ethernet segments as
broadcast beacons. Since they are not routable,
they are ignored. These events are labeled
[NULL_IP].
There are a variety of attacks that combine
specific source and destination ports to succeed.
Some of these attacks are attempts to bypass
network security devices and others are denial of
service in nature. The Network Sensor can be
configured to look for specific pairs of packets. It
is a good practice to use this feature when
filtering out certain traffic from port scans. For
example, many people configure the Network
Sensor to not look for port scans in web or DNS
traffic. Putting some key port pairs in here would
still detect source ported port scans.
There are four arguments to the PAIRS list:
source port, destination port, protocol, and name
of the event. Events of this type are named after
the one used in the list.
Technical Note
The maximum number of allowed PAIRS is 16.
Creating Network Sensor Policies and Signatures A-31
6.x to 7.x Mappings