Cli: Checking For Intrusions, Listing Intrusion Alerts, And Resetting; Alert Flags - HP ProCurve series 2500 Management And Configuration Manual

Using Passwords, Port Security, and Authorized IP Managers To Protect Against Unauthorized Access
The above example shows two intrusions for port 3 and one intrusion for
port 1. In this case, only the most recent intrusion at port 3 has not been
acknowledged (reset). This is indicated by the following:
• Because the Port Status screen (figure 7-7 on page 7-24) does not
indicate an intrusion for port 1, the alert flag for the intrusion on port
1 has already been reset.
• Since the switch can show only one uncleared intrusion per port, the
older intrusion for port 3 in this example has also been previously
reset.
(The intrusion log holds up to 20 intrusion records and deletes an
intrusion record only when the log becomes full and a new intrusion
is subsequently detected.)
Note also that the " prior to " text in the record for the earliest intrusion
means that a switch reset occurred at the indicated time and that the
intrusion occurred prior to the reset.
3. To acknowledge the most recent intrusion entry on port 3 and enable the
switch to enter a subsequently detected intrusion on this port, type [R] (for
Reset alert flags
or more ports, this step resets the alert flags for all such ports.)
If you then re-display the port status screen, you will see that the Intrusion
Alert entry for port 3 has changed to "
Intrusion Alert flag has been acknowledged (reset) is that the Intrusion Alert
column in the port status display no longer shows "
the intrusion occurred (port 3 in this example). (Because the Intrusion Log
provides a history of the last 20 intrusions detected by the switch, resetting
the alert flags does not change its content. Thus, displaying the Intrusion Log
again will result in the same display as in figure 7-8, above.)
CLI: Checking for Intrusions, Listing Intrusion Alerts, and
Resetting Alert Flags
The following commands display port status, including whether there are
intrusion alerts for any port(s), list the last 20 intrusions, and either reset the
alert flag on all ports or for a specific port for which an intrusion was detected.
(The record of the intrusion remains in the log. For more information, see
"Operating Notes for Port Security" on page 7-28.)
). (Note that if there are unacknowledged intrusions on two
". That is, your evidence that the
No
Configuring and Monitoring Port Security
" for the port on which
Yes
7-25