Enterasys Intrusion Prevention System Manual page 245

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
SYN-NONZERO
SYN-PATTERN
SYSLOG_ONLY
TCPCHECK
7.0 XML Attribute
NSC/SC/C/TransportLayer/syn-nonzero
NSC/SC/C/TransportLayer/LogSynPattern
NSC/SC/C/Logging/syslog-only
NSC/SC/C/TransportLayer/tcp-checksum
Description
Identical to NSC/SC/C/TransportLayer/syn-data,
except that all of the data in captured Syn
packets is analyzed for non-zero bytes. Most
operating systems that pad Syn packets with a
small payload of data, do it with zeros. This alert
indicates that a Syn packet was received that
contains a non-zero event. There is a very high
false positive rate with this event. These events
are also labeled [SYN-DATA], but includes a
nonzero data element in the event message
data.
Some suspicious network activity, such as TFN
2000, send data in TCP Syn packets. It is
perfectly legal for TCP sessions to send data in
Syn and Syn-Ack packets, but it rarely occurs.
LogSynPattern searches all TCP Syn packets for
a specific pattern. LogSynPattern specifies a list
of event names and data to look for in each Syn
packet that has a data payload. Data is specified
the same way it is in a dragon.sigs rule except
there are no wild cards or other complex rules. If
the pattern matches, an event occurs with the
specified event name.
Technical Note
The maximum number of rules is 6.
This keyword instructs the Enterasys IPS Sensor
to log output and debugging information to the
system log rather than to stdout or a file.
Instructs the Network Sensor to verify the
integrity of inbound TCP packets by calculating
their checksum and comparing it to the value in
the packet. If a discrepancy is discovered, the
packet is dropped. The value provided by this
keyword is used to indicate how often this test
should be carried out. A value of n will check
every nth TCP packet. Therefore, a value of 5
will check every 5th packet. This statistical
sampling technique is designed to balance
performance with TCP checksum verification.
Technical Notes
• The valid range for this keyword is 0 to 255.
• Use the value, 0, to check every IP checksum.
• This keyword does not generate an event. If
Deprecated is enabled, it will indicate that packets
are failing this test.
• The checksum verification will only be applied to
non-fragmented traffic. Fragmented packets will
only be evaluated after Enterasys IPS has
reconstructed the underlying IP packets.
Creating Network Sensor Policies and Signatures A-51
6.x to 7.x Mappings