IPS/IDS events generated with IP < n/a > instead of #. ###. ###. ###

Similar Questions

• IPS monitoring events Notes

  Hi all

  I have a group of IPS/IDS installed in our monitoring network of several segments.

  Usually and for the years seems always assorted events high severity or average lower and information.

  For about two months and so far, while monitoring the IPS/IDS, I noticed that I am not finding any event with high severity or average before there was daily sheets with high & gravity medium and all the Group of IPS / IDS is assigned with the same behavior not only on a single device.

  I will be happy if everything works normally with no corresponding severity, but I'm afraid that there is something wrong with the monitoring of our systems IPS /IDS.

  I find logs with gravity low and informational only.

  Please let know us if I can do the troubleshooting procedures

  Kind regards

  Software updates also contain an update of the signature. Any signature applied to a sensor IPS update will change the existing settings of the signing of the probe. New signings will be activated and existing signatures may be changed to provide better performance or to retire if they live on their usefulness.

  Configuration of the probe can be modified to affect what light signatures as well by setting the filters to event and action event overrides.

  -Bob

• Virtual design of IPS/IDS question.

  Hello! I am having some problems with the understanding of the design of the virtual IDS/IPS.
  I know how to do it with hardware IPS/IDS, when you have a physical interfaces specified to deal with traffic and another physical interface to send inspected traffic to the nucleus.

  My question is how do people there with virtual firewall? I mean, how it is possible to configure a server on VMWare to receive SPAN session (in the case of IDS) or something like that.

  I hope I can clarify my concern.

  You can actually do both. If you just want to monitor (IDS) then you will need to dedicate a physical port on your VM server and cover traffic towards it. For more information about that visit this link:

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalID=1004099

  If you want to place the inline virtual appliance, then you will need to devote two physical ports on your VM server. One of these ports will be used for the outdoor area and the other for your within the area of.

  I hope this helps!

  Thank you for evaluating useful messages!

• I want Docs on IPS / IDS

  Hello

  I am new to IPS /IDS, help with the Docs to read basic & MFIS on IPS / IDS.

  Concerning

  RAMU

  Here are some documents on the basis of the IPS product, IE: what it does, etc.:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5729/ps5713/PS4077/prod_brochure0900aecd805baea7.html

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5729/ps5713/PS4077/product_data_sheet0900aecd805baef2.html

  You want to reserve a specific configuration documentation, here, you will:

  http://www.Cisco.com/en/us/docs/security/IPS/7.0/Configuration/Guide/IDM/idmguide7.html

  (Version 7.x is currently the latest version on IPS).

  Hope that helps.

• Event generated by the user 'anonymous' the host 'CIS '. Could not get the reference.

  Hello
  
  We have integrated our portal customized with the AAU in document taskflows webcenter application.
  We are not able to view the Soum, extracted from the Complutense University of MADRID. Here's the error to get connected UCM whenever we access the application.
  
  Event generated by the user 'anonymous' the host 'CIS '. Could not get the reference. Can not read the file. [Details]
  An error has occurred. The stack trace below shows more information.
  
  ! csUserEventMessage, anonymous, CIS! $! csCollectionUnableToGetReference! csCollectionCannotRead
  intradoc.common.ServiceException:! csCollectionUnableToGetReference! csCollectionCannotRead
  * ScriptStack COLLECTION_GET_REFERENCE
  3:getReferenceMeta, * no captured values *.
  at intradoc.server.ServiceRequestImplementor.buildServiceException(ServiceRequestImplementor.java:2115)
  at intradoc.server.Service.buildServiceException(Service.java:2260)
  at intradoc.server.Service.createServiceExceptionEx(Service.java:2254)
  Collections. CollectionUserHandler.getReferenceMeta (CollectionUserHandler.java:1765)
  at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:48)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
  at java.lang.reflect.Method.invoke(Method.java:600)
  at intradoc.common.IdcMethodHolder.invokeMethod(IdcMethodHolder.java:86)
  at intradoc.common.ClassHelperUtils.executeMethodReportStatus(ClassHelperUtils.java:324)
  at intradoc.server.ServiceHandler.executeAction(ServiceHandler.java:79)
  at intradoc.server.Service.doCodeEx(Service.java:533)
  at intradoc.server.Service.doCode(Service.java:505)
  at intradoc.server.ServiceRequestImplementor.doAction(ServiceRequestImplementor.java:1643)
  at intradoc.server.Service.doAction(Service.java:477)
  at intradoc.server.ServiceRequestImplementor.doActions(ServiceRequestImplementor.java:1458)
  at intradoc.server.Service.doActions(Service.java:472)
  at intradoc.server.ServiceRequestImplementor.executeActions(ServiceRequestImplementor.java:1391)
  at intradoc.server.Service.executeActions(Service.java:458)
  at intradoc.server.ServiceRequestImplementor.doRequest(ServiceRequestImplementor.java:737)
  at intradoc.server.Service.doRequest(Service.java:1890)
  at intradoc.server.ServiceManager.processCommand(ServiceManager.java:435)
  at intradoc.server.IdcServerThread.processRequest(IdcServerThread.java:265)
  at intradoc.server.IdcServerThread.run(IdcServerThread.java:160)
  to weblogic.work.SelfTuningWorkManagerImpl$ WorkAdapterImpl.run (SelfTuningWorkManagerImpl.java:528)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:207)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:176)
  
  Kind regards
  Francis P

  What is the security group of your records? It is public.

• Event generated when swf was loaded

  Hello

  I've been to this search but nothing. I need to use an event generated when the site is loaded for the first time (manage the resizing of the scene). This is because the 'resizestage' event is generated only when I resize, so the first time the site had been loaded, the size is not changed.

  Is there something?

  So the addition of the ENTER_FRAME seems logical. Assuming that your site is a long frame? How many images in your scenario "main"?

  This function simply says:

  1) when you enter the first image access the function of "loading".

  2) the total number of bytes of the file loading

  3) also get the number of bytes currently loaded.

  4) if the total number of bytes is equivalent to the bytes that are loaded

  5) remove the eventListener so that it doesn't keep getting called

  6) then do your resizing scene or call another function.

  function loading(e:Event):void {}
  (2) var total: Number is this.stage.loaderInfo.bytesTotal;.
      (3) var loaded:Number is this.stage.loaderInfo.bytesLoaded;.

  (4) if (total == load) {}
            (5) this.removeEventListener (Event.ENTER_FRAME, loading);

  (6) / / do your resizing once loaded .swf file

  or call another function

  }
  };

  (1) this.addEventListener (Event.ENTER_FRAME, loading);

  In addition, wouldn't you want to do with a scene of charger?

• Is there any event generated when I move any window or windows media player from primary monitor to secondary monitor.

  Original title: media Player from the window of the main monitor to the secondary display.

  Hello

  Whem I'm moving my Windows Media Player fromprimary on secondary screen (or any other window),

  is there an event generated by the Windows operating system?

  If yes how can I capture this event?

  Best regards

  Sharad

  Hello

  There is no event that is generated when you move any program or any window from primary monitor to secondary monitor.

  For more information visit: How to view and manage the event logs in in Windows XP Event Viewer

• How (if possible) I point out a whole day in the Windows calendar instead of just a single event? (With the help of Vista Ultimate) Thank you.

  How (if possible) I point out a whole day in the Windows calendar instead of just a single event? (With the help of Vista Ultimate) Thank you.

  I have no experience with Windows Calendar, but see this article for a bit of luck:

  Customize Windows Calendar
  http://Windows.Microsoft.com/en-us/Windows-Vista/customize-Windows-Calendar

• New archives are generated with 640 causing permission extracted from abend

  Hi all

  We have configured the normal extraction process (not ALO). But whenever from trying to read archives abends with error permission denied archiving log.

  We noticed that the newly created archives are courtesy of 640. We do not use the user oracle to GG, we have created different user OS for GoldenGate.  We changed the permissions on the mountpoint of archives but the ancient archives only modified permissions and not the archives newly generated.

  GoldenGate OS user cannot be group DBA as company policy allows for no do. Default umask is 022

  The 10.2.0.4 basic version

  OGG version 11.2

  Any help will be really appreciated. Just that the archives are generated with 644 permissions.

  Thank you and best regards.

  Trush.

  This is a default permissions by oracle internally and cannot be changed. Therefore, the solutions are,

  1 schedule a cron task to change permissions.

  2. Add the OS GG group DBA user.

  Thank you

• IDML generated with InDesign CC

  Hello

  I'm not sure to know if it is my mistake or some clients do not know how to manage files. Is that a chance for InDesign CS4 cannot open an IDML file generated with InDesign CC?

  I usually export an InDesign CC as IDML file. As far as I know that any version of InDesign CS to CS4 (that it) should be able to open it.

  Am I wrong? There are few customers who actually said that they can not open. Now, I don't know if they tried to open the IDML or InDesign file. I'm always downsave files InDesign to IDML just in case a client has a previous version of InDesign. I use InDesign CC for Mac.

  For InDesign CS3, I know that it is imperative to open IDML with InDesign CS4 and then re - export as INX.

  Any input would be appreciate it.

  Best regards,

  Sebastian

  Post edited by: sebdea

  The theory is that all versions of CS4 to the front should be able to open any version .idml, but I swear that this is true in practice. We had a few other similar reports with CC .idml. I would check to see the .idml will reopen its doors in CC and CS5 or 6, too. It might just be bad.

• Satellite A210 - 10 c only works with the 800 Mhz instead of 1.6 Ghz

  Hello

  I have a very big problem. One day, I look in Vista on my resource monitor and see that the max freuquence is only 50%.

  So first of all I think that is no problem because the assets 'energy savings' energy recorded.
  I have a Satellite A210 - 10 c portable.

  So I switch to maximum power and perform a test of prime95. But hell, the max freuquence has not changed. I also installed everest and cpu z, but all programs show the same to me:

  My laptop only works with the 800 Mhz instead of 1.6 Ghz!

  I'm looking for drivers for the AMD processor, but you need not for Vista. Update all the drivers of Toshiba and Programms and BIOS (in fact, it is the 1.9).

  Nothing helps.

  As a last test, I reinstalled Vista, but also did not help.

  And now I'm at a loss what to do.

  I hope someone can help me.

  Good bye...

  Have you installed the Vista using the recovery CD or the original CD of Microsoft Vista?

  I ask because the restore CD contains all drivers for Toshiba and yellow exclamation marks should not be apparently in Device Manager.

  If you used the original CD of Vista I think that you have not installed the Package of Intel Robson.

  I found the package of Robson on the Toshiba driver-> Satellite P200 area page.

  Maybe you should check this.

  Your comments would be appreciated

• IPS sensor - Event Notification by e-mail?

  Good day to all.

  I was asked to recreate some features after he lost the customer improved VMS to the CSM but without CS-MARCH or any other event monitor. The user has had the system to generate an email when an event was triggered. He was apparently noisy initially but after setting wasn't a bad solution. No one knows how he was initially put in place but I can only assume it is the method that is described in the Cisco document to: http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml#fivesensor

  Now, however, since the CSM has not received the event data is it possible to recreate this process of "notification"?

  Are using CSM 3.02 and the sensors are still at 5.14. The sensors will be updated to 5.17 later today. I will then either be upgrading the client to the latest revisions and service to CSM or rolling packs to the VMS depending on whether I can get notifications to work with MSC.

  NOTE: They order a CS-MARS appliance with the conviction that it will solve the problem, but as the last word, it will be several months at least before they could get it. I'm afraid that CS-MARS will NOT give back them this feature. Can you confirm/deny?

  Finally - CSM does not include a security monitor, as did virtual machines, and CS-MARS not really recreate that kind of view or the management of the events - what solutions are there to reproduce the functionality of the Security Monitor? Are there? Is-CS-MARS the new bully on the block?

  Since the client is to stay at a 5.1 version, then you have 3 options:

  1) down to virtual machines and continue to use the Security Monitor

  2) stay with the CSM and buy CS-MARCH for the monitoring of events. CS-MARS should provide the ability to e-mail notification.

  3) stay with the CSM and installing and using VEI 5.2 (1).

  VEI 5.2 (1) can be installed either on a separate machine from the CSM as a stand-alone utility:

  http://www.Cisco.com/cgi-bin/tablebuild.pl/IPS-EV

  VEI 5.2 (1) contains the new alerts e-mail notification feature.

  GOLD VEI 5.2 (1) can be installed as part of the installation of CSM (I know it's in the CSM 3.1, but don't know about previous versions of CSM).

  Here are a few documents on the execution of the IEV 5.2 (1) in the CSM framework:

  http://www.Cisco.com/en/us/partner/docs/security/security_management/cisco_security_manager/security_manager/3.1/user/guide/monidiag.html#wp1203768

  NOTE: VEI 5.2 (1) is targeted for use in networks with sensors of 5 or less. When running with 5 sensors or more, then CS-MARS would be the veiwer advised.

  When the user later upgraded to version 6.x, then option 1 (downgrading to virtual machines) is no longer an option and option 2 or 3 would be required.

• NAC Vs IPS/IDS

  Hi all

  One of the clients has secured several locations. Each location has its own Internet access. Hand and DR data centers had ASA5510. Remote users use connections IPSEC RA and Citrix (ms principal then road to internal n/w). What is the best solution... NAC or IDS/IPS for security?  My guess is, with many internet, client access points may have to opt for the solution at each location. Also, is there any document that explains the differences between the NAC Vs IDS/IPS?

  TIA

  MS

  I always place the IPS sensor inside the firewall. In this way, just to inspect the traffic that gives thanks to the firewall policy and the sensor generates alerts will be most valuable in terms of actual intrustions, that you should be aware.

  If the traffic passing thought your DS3 router is encrypted in a VPN tunnel, a router based IPS will not be able to inspect traffic within the VPN.

  You will need to inspect, once it has been deciphered. This could be done in the ASAs or with a sensor of the external device, like a 4240.

  -Bob

• Difficulties to view events generated by the SSM-GOAL-10 on server CETS

  Hello

  Is there a trick that can help me to see the xml file generated by the CETS-server in a more convenient way. See attachment for more details.

  The events are interwoven with html tags.

  Thank you

  Julie

  Julie-

  If you don't want to read XML, you then have a script that it will look into something that is readable.

  I would suggest installing the free IPS Manager Express and pulling on the events of the probe, you want to see in it.

  Then, you can browse events in IME or export them to HTML or CSV format.

  Each sensor can send traffic events for up to 5 collectors event (even if it will cost you some processing on the sensor power to maintain additional sessions).

  -Bob

• Multitone generator with more entries and exits of computer speakers

  I would like to add several harmonically related sinewave tones (maybe 10) and output for computer or line out speakers. Ideally want to use full range audio 44100 Hz sampling rate as well. I managed to combine two or three screws and get something that works to but lower sampling frequencies be dynamically updated if I change of frequency or phase. And to higher sampling frequency, it is not a continuous sound. It just beeps, then waits, beeps and then waits. I'm sure that oters have attempted to address this problem in the past but can't find much info. Currently using a Mac but could switch to a pc if necessary. Orientation will be most graciously accepted.

  I found several things that keep all your VI to work as you wish. The attached VI works fine on my Mac.

  1. I configured the sound and tone generator to use the same sampling information. Any other combination creates complications.

  2. I discovered the hard way that the tone generator wants the frequency to be an integer multiple of /(# samples) (sampling frequency). It does not appear in the documentation (help file) but other combinations Sunrise errors.

  3 set the input of the amplitude (not your Amplitudes) on the Generator.vi of Multitone to 1.00. This makes its compatible with the screw Sound output. It is documented in the help, but it must be read in several places and set up thepieces.

  4. the reset to Multitone Generator.vi entry must be filled to deal with changes in frequencies, amplitudes or phases. I connected just a real constant for now. Later, this could be better managed by a structure of the event.

  5 consider the frequency, amplitude, and phase controls at tables or a 2D array as an arbitrary number of tones can be used without changing the program.

  6. a sort of waiting may be required. Without it, I sometimes got a timeout error. Several options are often different from the Structure off the diagram. The sound output wait will ensure that the time-out does not occur, but it also produces small openings in the sound. Forward (ms) works well enough, but it's a guess as to the optimal value for the wait.  After all the changes, I have madevene that the any waiting seems to work.

  Lynn