Enterasys Intrusion Prevention System Manual page 229

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
PROTECTED
PROTO
PSDISTRIB
PSPING
7.0 XML Attribute
NSC/SC/C/ProtectedNetwork
NSC/SC/C/NetworkLayer/LogProtocol
NSC/SC/C/ProbeDetection/distributed-host-per-port
NSC/SC/C/ProbeDetection/distributed-ports-per-host
NSC/SC/C/ProbeDetection/protocol-ping
Description
The Network Sensor needs to know about the
network it is running on to give meaning to the
packets it collects. "Deprecated" on page A-20
specifies a range of IP addresses that constitute
'the good guys' that the Network Sensor is
protecting. Based on source and destination IP
address, any packet can be classified as going
to, or leaving the protected network. Packets can
also be completely outside or inside the
protected network.
Technical Notes
• Consider super classing CIDR blocks where
possible to increase the efficiency of the Network
Sensor.
• Enterasys IPS allows for a maximum of 24
protected networks.
Used to log packets based solely on IP protocol.
Events of this type are named [PROTO].
Technical Notes
• To set the protocol as a wildcard, use the value, 0.
• The maximum number is 16.
Evaluates incoming traffic for distributed port
scans. This is accomplished by ignoring the
source IP address and source port while
applying the threshold of ports. Another
threshold of the number of source hosts must be
broken to produce an event. This is to prevent
this keyword from duplicating events of the
"NSC/SC/C/ProbeDetection/hosts-per-port" on
page A-34.
Technical Notes
This keyword can produce the events:
DISTRIB-TCPSCAN
DISTRIB-UDPSCAN
Enables the Enterasys IPS Sensor to generate
events when network topology scans are
detected. These scans are defined as one
external machine sending packets to multiple
protected network computers. These packets are
only evaluated for their source and destination IP
addresses. Other information such as protocol or
port number are disregarded for this keyword.
Requires one argument to specify the threshold
of internal machines that must receive packets
before alerting.
Technical Note
Produces NETWORK-DISCOVERY events.
Creating Network Sensor Policies and Signatures A-35
6.x to 7.x Mappings