Enterasys Intrusion Prevention System Manual page 239

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
SNIPER
7.0 XML Attribute
NSC/SC/C/ActiveResponse/Sniper
Description
This feature can turn the Network Sensor into a
light firewall suitable to stop TCP and UDP
traffic. If the Network Sensor observes network
traffic, which corresponds to a rule for
termination, the Network Sensor will emit the
appropriate TCP reset or ICMP port-unreachable
packets. The reset packets terminate TCP
sessions, and the ICMP packets attempt to
terminate UDP sessions. For UDP traffic, the
ICMP packet will not stop the UDP session from
occurring, but most UDP applications such as
NFS, DNS queries and traceroutes believe the
first few packets they receive. In these cases, the
ICMP packet is highly effective in stopping UDP
traffic.
The format of the Sniper access control list is
first the keyword, Sniper, then a list of rules.
Each rule is specified as an ignore or sniper
rule with either an I or an S. Then the protocol is
indicated with either a T for TCP or U for UDP.
The source IP CIDR block follows. Use 0.0.0.0/0
for a wild card. The source port then follows. Use
0 for a port wildcard. The corresponding
destination CIDR block and port finish the rule.
The Network Sensor applies each packet to this
access control list in a fall-through fashion. If no
rule matches, packets pass without any action
based on the Network Sensor. If a sniper rule
matches, the Network Sensor will attempt to
send four packets, which will disable the
offending TCP or UDP session.
As with the TCP_ECM rule, beware in using this
feature. It is trivial for the Network Sensor to be
coerced by hackers to send packets to places
like www.whitehouse.gov. By spoofing packets
from a target machine outside of the Network
Sensor's view, an attacker could use the
Network Sensor as an unwitting amplifier in a
denial of service attack.
USE WITH CAUTION!
When the Network Sensor makes these alerts,
they are logged with a [SNIPER-TCP] or
[SNIPER-UDP] event.
Technical Notes
• This feature is only available on Ethernet sensors.
• Sniper can also be applied when running in IPS
mode.
• The maximum number of sniper rules that can be
entered into the Enterasys IPS configuration is 32.
Creating Network Sensor Policies and Signatures A-45
6.x to 7.x Mappings