Enterasys Intrusion Prevention System Manual page 237

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
SERVER
(Continued)
SESSION
7.0 XML Attribute
NSC/SC/C/TransportLayer/LogServer
NSC/SC/C/TransportLayer/LogSession
Description
For network 10.100.100.0/24, the following
example shows what it would be to ignore that
traffic and log any new active TCP services.
Network Sensor can be configured to look for
Syn-Ack packets coming from outside your
network on very high ports. There are a lot of
false positives with this technique, but if a Syn-
Ack packet is coming from a high port, that
means that someone on your internal network is
going to it, or the packet has been spoofed. For
example, the Netbus backdoor operates on port
12345. Looking for Syn-Ack packets from your
network may indicate Netbus infection, but
looking for traffic returning from port 12345 to
your network could indicate that someone on
your network has been probing for Netbus.
As of Network Sensor 4.0, the SERVER has
included the ability to dynamically define the
number of additional packets to log when these
alerts start. This can drastically increase the
amount of data logged to the local hard drive, but
it can also be used to collect a specific number of
packets, which occur after the start or stop of a
network session. To define the additional number
of packets logged, add it in as an additional
argument.
Technical Note
The maximum number of SERVER rules is 16.
Similar to NSC/SC/C/NetworkLayer/LogStatic
feature of Network Sensor, but it is intended to
log specific network sessions such as Telnet or
FTP. The LogSession is followed by a list of
logging rules. These rules have three arguments.
They are the logging action, the IP address of
interest and the target ports. Logging action is
either an L to log traffic or an I to ignore it. An IP
address can be a normal IP address, or a
network block specified with a bit mask. Finally,
the port is either zero for any port or the specific
port. Ports count for either UDP or TCP. Logging
occurs if the source or destination IP address
and port matches the particular logging rule.
Once captured by Network Sensor, there are
several tools that can play back multiple
recorded sessions. Events of this type are
logged with the [SESSION] name.
Technical Note
The maximum number of LogSession rules is 20.
Creating Network Sensor Policies and Signatures A-43
6.x to 7.x Mappings