Explanations of IPS/IDS signatures?

Similar Questions

• Virtual design of IPS/IDS question.

  Hello! I am having some problems with the understanding of the design of the virtual IDS/IPS.
  I know how to do it with hardware IPS/IDS, when you have a physical interfaces specified to deal with traffic and another physical interface to send inspected traffic to the nucleus.

  My question is how do people there with virtual firewall? I mean, how it is possible to configure a server on VMWare to receive SPAN session (in the case of IDS) or something like that.

  I hope I can clarify my concern.

  You can actually do both. If you just want to monitor (IDS) then you will need to dedicate a physical port on your VM server and cover traffic towards it. For more information about that visit this link:

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalID=1004099

  If you want to place the inline virtual appliance, then you will need to devote two physical ports on your VM server. One of these ports will be used for the outdoor area and the other for your within the area of.

  I hope this helps!

  Thank you for evaluating useful messages!

• I want Docs on IPS / IDS

  Hello

  I am new to IPS /IDS, help with the Docs to read basic & MFIS on IPS / IDS.

  Concerning

  RAMU

  Here are some documents on the basis of the IPS product, IE: what it does, etc.:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5729/ps5713/PS4077/prod_brochure0900aecd805baea7.html

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5729/ps5713/PS4077/product_data_sheet0900aecd805baef2.html

  You want to reserve a specific configuration documentation, here, you will:

  http://www.Cisco.com/en/us/docs/security/IPS/7.0/Configuration/Guide/IDM/idmguide7.html

  (Version 7.x is currently the latest version on IPS).

  Hope that helps.

• PIX IDS signatures

  Does anyone know the PIX IDS signatures to block Ping scans and Port scans?

  Do the substitution of signatures IDS ACL defined previously? For example; I want to allow people to ping - me (I allowed icmp echo in my ACL), but I want to drop Ping Sweeps and Port scans.

  Gracias.

  PIX IDS signatures are all listed here:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_62/syslog/pixemsgs.htm#1032267

  You will notice that it isn't sigs for the port scans and ping sweeps, mainly because it does not detect the PIX. This would imply the PIX to keep track of all the pings or connection attempts and try to understand that if a scanning goes, this is not what the PIX is designed for.

  If you want to see these then a NID system is the best way to go. IDS PIX is very limited and don't look for a very small subset of the signatures, and most of these signatures simply consist of a package, do not try to reconstitute several packages to different hosts or ports.

• Can I update (IDS) signatures to a router with IOS/FW/IDS?

  I have a router with IOS FW/IDS version 12.2.3 3725. Can I update the IDS signatures?

  Sorry, but isn't the answer. IOS IDS signatures are hard coded in the code of IOS. They are rarely updated. All you can really do is allow them or not and some simple check of what they catch.

  HTH,

  Travis

• IPS 4200 Signature & Action IDs

  I need a manual of reference for a list of all signatures and actions supported by the Cisco IPS 4200 Series devices with version 6.x software.

  I tried to locate it through the page of the product IPS but had no luck yet.

  Please let me know where I can find this reference manual.

  Thank you.

  Have you looked at the Security Center?

  http://Tools.Cisco.com/Security/Center/search.x?search=signature

  Concerning

  Farrukh

• ASA 5505 IPS/IDS Module

  HI Experts,

  Can you please give me an idea on what this module IDS/IPS for ASA 5505?

  How much does it cost? How to install and configure to work with ASA 5505?

  We have also a few site to site of ASA 5505 VPN configuration. This would affect somehow?

  Thank you very much

  ANUP

  ANUP-

  You should be able to find the links that I provided for you with a general search on Cisco's Web site for 'ssc-5' and 'installation' and 'configure '.

  No, you should still ASA terminate Internet access. You want to have the SSC-5 module (IPS) to monitor the interfaces from the INSIDE, (always wanting to make IDS/IPS inside a firewall). This way you can see the traffic after it has been decrypted on your VPN, and after the traffic has been filtered to your firewall rules.

  -Bob

• TCP Hijack on IDS signature

  Someone has a lot of experience with the 'TCP Hijack' signature on the IDS sensors? I checked the NSDB and docs IDS for the engine in question, but neither go into details on how to determine if alerts are false or true positives.

  Any comments would be much appreciated.

  Thank you very much

  Matt

  Under the version of Cisco IDS 3.x, Hamid 3250 only looked at a few ports (TCP 21, 23, 513 and 514, if I remember correctly).

  With the introduction of version 4.x, the signature was no longer limited to these ports. Thus, at least here, we were see a large number of "false positives" involving the web proxy traffic and NetBIOS traffic. BTW, I have no idea if the signature has been coupled to the ports under version 5.x (someone?).

  The logic that we apply to all alarm hamid 3250 we see here is based on two factors: intent and feasibility.

  Although it is theoretically possible to divert most oriented session TCP connections between a client and a server, there are some that simply make no sense.

  If you take alarms involving TCP port 80, what would be the point to divert someone connecting to a web server? Anything sensitive that someone could do this using a browser is done via HTTPS (SSL/TLS aka), so Cryptography will eliminate the threat of hijacking it. So now you re left with web access unsecure. what you are more likely to find if divert you this? Someone looking at the comic strip Dilbert, or something as I imagine... I think you will agree that, therefore, there is no intention at all.

  As with any attack of diversion, the feasibility is quite low. Most of these attacks requires that the hijacker be in the same domain as the intended victim. That being said, it goes without saying that you aren t also see cache poisoning attacks ARP or TCP Syn flooding (or another DoS attack against the victim), you aren t see a valid hijack alarm. Of course, the problem here is that these activities usually occur in an area that is not supervised by a NIDS, then you will need other corroborating data to see (HIDS/NNIDS, router logs).

  In all cases, these alarms are not very useful on their own. When they become valuable, in my opinion, is when they appear in concert with other alarms (e.g. Hamid 7105 - imbalance of ARP requests).

  I hope this helps.

  Alex Arndt

• Cisco IPS 4200 Signature Update

  We are currently under evaluation and implementation of the Cisco IPS solution to our security needs.

  Our supplier has said that the signature 'online' updates to Cisco IPS is not possible - this is a manual process and we need to charge the device if you want to update the files.

  Somehow, it defies logic. Surely, I think, that any IP address should have the possibility of obtaining signatures updated "online".

  I apologize, because that question is too basic in nature. But could someone shed more light on this?

  Thank you.

  You have auto update functionality of Cisco IPS version 6.0, take a look at the attached picture.

  Update of signatures is * recommended * that you reload the signatures (restart the sensor), although this is not mandatory.

  Our IPS has not been restarted for over two months now and everything is working ok.

  Automatic update

  Automatic update

  Automatic update

• WLC v4.2.112.0 - IDS Signatures - Deauth/Auth and flooding of the Assoc

  Hi all

  My apologies if this has already asked. There seems to be several posts with people getting critical alarms and they are due to bugs in Cisco?

  Couple of points.

  I am under the above version and I'm getting a lot of IDS Deauth Auth and Assoc alarms on WLCs/WCS.

  How can I find out if these are some releated bug or not?

  Also, does anyone know how these three and the other signature attack work? IE, a deauth is a number of deauth messages sent to an access point, but how much is sent before the WLC reports on them? That is to say, what are the criteria to generate the IDS alarms. Also for other signature attacks?

  It doesn't seem to be too docs on the web?

  Many thx and sincere friendships,

  Ken

  Ken:

  It is a region that has been a bit murky documentation. There have been a number of requests for better documentation, but we are still waiting to see.

  Surprisingly, one of the best forms of

  "documentation" is by examining the signature file wireless IDS which has a few comments and explains how settings work. You can see what a little enlightening.

  In addition, when it comes to false alarms, we have seen a number of them in various flavors. Here are a few thoughts:

  If you run "containment" or rogue APs, wireless ID system currently interprets its own messages of containment as a false-positive/attack. This is a known bug ( CSCsj06015 ) that says: it is fixed, but to my knowledge continues to be a problem.

  Here is a link to the bug:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj06015

  Also, when some brands of customers go out of scope, a string of messages disassociation is sent via the Russia Federation to ensure that the RF connection is broken. However, the number of these legitimate trusts sometimes exceeds the allowed value in the signature CODES of Cisco Wireless file and the WLC erroneously interprets as a false positive / attack, whereas in fact, it's a normal approval. The number of detections per second value can be adjusted (in fact, the proposed TAC make some changes here - but this really needs to be better set at the factory to prevent them to ancestral). One of the links below explains the methodology to change wireless IDs. The most recent versions of the WCS/WLC are supposed to allow a change of parameter/GUI based these parameters vs export/edition/download the signature file wireless IDS on/in each WLC.

  For your reading pleasure, here are some links that you might find useful who discuss various wrinkles in wireless IDs:

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddf672c/0#selected_message

  http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Expert%20Archive&topic=Wireless%20-%20Mobility&topicID=.ee7f999&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbf522e/16#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbf520e/1#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbeccbc/0#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddfaecb/1#selected_message

  Thank you

  John

  (Don't forget to rate helpful messages)

• NAC Vs IPS/IDS

  Hi all

  One of the clients has secured several locations. Each location has its own Internet access. Hand and DR data centers had ASA5510. Remote users use connections IPSEC RA and Citrix (ms principal then road to internal n/w). What is the best solution... NAC or IDS/IPS for security?  My guess is, with many internet, client access points may have to opt for the solution at each location. Also, is there any document that explains the differences between the NAC Vs IDS/IPS?

  TIA

  MS

  I always place the IPS sensor inside the firewall. In this way, just to inspect the traffic that gives thanks to the firewall policy and the sensor generates alerts will be most valuable in terms of actual intrustions, that you should be aware.

  If the traffic passing thought your DS3 router is encrypted in a VPN tunnel, a router based IPS will not be able to inspect traffic within the VPN.

  You will need to inspect, once it has been deciphered. This could be done in the ASAs or with a sensor of the external device, like a 4240.

  -Bob

• IDS signatures

  Hello

  Some exist tool to develop signatures for new protocols in Cisco IDS?

  Thank you

  Leandro.

  I do not exactly understand your question, but here's a link to the documentation about the writing of signatures for the Cisco IDS devices. I hope this helps.

  http://www.Cisco.com/en/us/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00801a0c28.html

• IPS/IDS events generated with IP < n/a > instead of #. ###. ###. ###

  Hello

  I see the events in SecMon with the IP of victim or an attacker of .

  How can I filter these events?

  I can't implement an action event filter in the IDM as the is not acceptable as a victim or abuser IP.

  It's weird that a signature for TCP traffic generates the src or dst as as in the IP header, there is a src & the dst field...

  Name of the GIS: TCP Hijack

  SIG ID: 3250

  Severity: high

  Risk assessment: 85

  GIS version: 212

  Attack type: General attack

  Operating system family: General OS

  OPERATING SYSTEM:

  Protocol: tcp

  Details of the Protocol: TCP

  Service:

  Forward address:<>

  Attacker Port:<>

  Attacking Loc: OUT

  Unreliable attacker: false

  The victim address: 198.133.219.25

  Port of the victim:<>

  Thank you

  JP

  These were not the Analytic events, were they? Those who might summarize on the source or target with the reverse being labeled as "0.0.0.0". Can you look on the sensor to the raw event and see if that information is present?

• Available to multiple IDS signature appearances?

  My wife and I need digitally sign a Bank document.  The document requires us to both full signatures and original place in several places.  Given that I have received the document in electronic format, I electronically sign documents.

  I use Acrobat 9 Pro on Windows XP 32-bit (my work computer), and I've never used before digital signatures, so I started by creating an ID for myself.  I used the following steps:

  1. I created my ID with my contact information (name, e-mail address, etc.).
  2. I asked a strong password for the signature.
  3. I created an appearance that contained the current date and a JPEG of my signature.
  4. I created a different appearance which contained just my initials.
  5. I created a last appearance which contained just my name.
  6. I saved the key to a PFX file.

  I then started the same steps to create an ID for my wife (on the same Windows account and without close Acrobat).  I thought that when I created a new ID that Acrobat creates an ID without appearances.  Instead, all appearances, I created for my ID was available for the ID of my wife, too.  So, I was able to place a signature to aid ID of my wife but the image was my signature.

  I missed something?  Appearances stored with the ID, and if so, how Acrobat separate them among the ID?  I looked through the help of Acrobat, but the only site that I found one spoke creation of appearances, and he did not work with more than one.

  Any help is appreciated.  Thanks in advance.

  Matthew

  Hi Matthew,

  Acrobat (and when I say Acrobat I mean really both Acrobat and Reader) save the appearances and the digital ID files in the space of the user as assigned by the operating system. If you do not log on when you start the computer (which is just, it starts and you find yourself on the desktop) then there is probably only one user, which was created when you set up the computer. If you have a log on screen when you select a user name and type a password then there is probably accounts for you and your wife. Anyone logged in as this is where the files will be stored. Specifically, I am referring to C:\Documents and Settings\\Application Data\Adobe\Acrobat\9.0\Security where will depend on the journal in the name.

  I hope this helped,

  Steve

• Cisco ips automatically updated link signature?

  Hi all
  I would like to know what address or the link that we need to the IPS-4240 signature automatically update from cisco.
  In our Setup IPS show this link. is this correct?
  username sabirins1978
  Cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
  Thank you.
  Kind regards
  Budy

  Yes like the following should work

  https://www.Cisco.com/cgi-bin/front.x/IDA/Locator/Locator.pl

  Concerning

  Farrukh