Configuring The Protocol Analysis Module - Enterasys Intrusion Prevention System Manual

Configuring the Protocol Analysis Module

10. Configure the Monitored Port Ranges table to specify which port ranges you want Network
Sensor to consider when analyzing for port scans and sweeps. Enter a port number in the
Beginning Port and End Port fields, then click Add.
There are a variety of port scan and port sweep signatures that exist in normal network traffic.
For example, most web browsers choose a local source port when connecting to port 80 on the
web server. For every new web request, the web browser usually increments its local source
port. This can be considered a port scan because it looks like the web server is connected to the
client on many different ports. One way to combat this is to tell Network Sensor all of the
target ports that should be monitored for port scans.
11. To remove a configured port range, select the desired row in the table and click Delete.
12. Click Commit to add your changes to the policy being configured.

Configuring the Protocol Analysis Module

This module allows you to configure the Network Sensor to perform analysis on a variety of
protocols. Basically, this module checks whether packets meet the requirements of the relevant
protocol RFCs.
Note that some of the protocol analysis techniques in this module are enabled by default and some
are disabled by default, so when you add this module to a custom policy, you should check the
default configuration of the protocols in which you are interested.
This section briefly describes the protocols but does not explain all the configurable options since
we assume you have intimate knowledge of the protocols if you are changing the default values.
For information about...
DNS Analysis Configuration
FTP Analysis Configuration
Finger Analysis Configuration
H.225 Analysis Configuration
H.245 Analysis Configuration
HTTP Analysis Configuration
ICMP Analysis Configuration
MGCP Analysis Configuration
RIP Analysis Configuration
RPC Analysis Configuration
SIP Analysis Configuration
SMB Analysis Configuration
SNMP Analysis Configuration
Telnet Analysis Configuration
2-50 Creating Network Sensor Policies
Refer to page...
2-51
2-54
2-56
2-58
2-61
2-63
2-66
2-69
2-72
2-74
2-78
2-81
2-83
2-85