PIX IDS signatures

Similar Questions

• Can I update (IDS) signatures to a router with IOS/FW/IDS?

  I have a router with IOS FW/IDS version 12.2.3 3725. Can I update the IDS signatures?

  Sorry, but isn't the answer. IOS IDS signatures are hard coded in the code of IOS. They are rarely updated. All you can really do is allow them or not and some simple check of what they catch.

  HTH,

  Travis

• PIX: IDS drop allowed vs ACL

  Do the substitution of signatures IDS ACL defined previously?

  If I allowed response echo in my ACL, but I put the ID to drop packets in response to echo, which will make the PIX?

  The ACL or the ID have precedence in PIX?

  DROPS number ID substitute allowed ACL.

• TCP Hijack on IDS signature

  Someone has a lot of experience with the 'TCP Hijack' signature on the IDS sensors? I checked the NSDB and docs IDS for the engine in question, but neither go into details on how to determine if alerts are false or true positives.

  Any comments would be much appreciated.

  Thank you very much

  Matt

  Under the version of Cisco IDS 3.x, Hamid 3250 only looked at a few ports (TCP 21, 23, 513 and 514, if I remember correctly).

  With the introduction of version 4.x, the signature was no longer limited to these ports. Thus, at least here, we were see a large number of "false positives" involving the web proxy traffic and NetBIOS traffic. BTW, I have no idea if the signature has been coupled to the ports under version 5.x (someone?).

  The logic that we apply to all alarm hamid 3250 we see here is based on two factors: intent and feasibility.

  Although it is theoretically possible to divert most oriented session TCP connections between a client and a server, there are some that simply make no sense.

  If you take alarms involving TCP port 80, what would be the point to divert someone connecting to a web server? Anything sensitive that someone could do this using a browser is done via HTTPS (SSL/TLS aka), so Cryptography will eliminate the threat of hijacking it. So now you re left with web access unsecure. what you are more likely to find if divert you this? Someone looking at the comic strip Dilbert, or something as I imagine... I think you will agree that, therefore, there is no intention at all.

  As with any attack of diversion, the feasibility is quite low. Most of these attacks requires that the hijacker be in the same domain as the intended victim. That being said, it goes without saying that you aren t also see cache poisoning attacks ARP or TCP Syn flooding (or another DoS attack against the victim), you aren t see a valid hijack alarm. Of course, the problem here is that these activities usually occur in an area that is not supervised by a NIDS, then you will need other corroborating data to see (HIDS/NNIDS, router logs).

  In all cases, these alarms are not very useful on their own. When they become valuable, in my opinion, is when they appear in concert with other alarms (e.g. Hamid 7105 - imbalance of ARP requests).

  I hope this helps.

  Alex Arndt

• Explanations of IPS/IDS signatures?

  Anyone know where I can find an explanation of the individual signatures that are used in a 4215?

  Thanks in advance!

  Hello

  All Signatures IDS/IPS can be found in the section My SDN. You can click on any of the Signature ID or release and enter the details of the information.

  You can visit my SDN (required ORC) at http://tools.cisco.com/MySDN/Intelligence/searchSignatures.x?currentPage=1&st=sd&so=d

  Hope that helps,

  Please rate if this can help.

  Kind regards

  Samuel Wilson

• WLC v4.2.112.0 - IDS Signatures - Deauth/Auth and flooding of the Assoc

  Hi all

  My apologies if this has already asked. There seems to be several posts with people getting critical alarms and they are due to bugs in Cisco?

  Couple of points.

  I am under the above version and I'm getting a lot of IDS Deauth Auth and Assoc alarms on WLCs/WCS.

  How can I find out if these are some releated bug or not?

  Also, does anyone know how these three and the other signature attack work? IE, a deauth is a number of deauth messages sent to an access point, but how much is sent before the WLC reports on them? That is to say, what are the criteria to generate the IDS alarms. Also for other signature attacks?

  It doesn't seem to be too docs on the web?

  Many thx and sincere friendships,

  Ken

  Ken:

  It is a region that has been a bit murky documentation. There have been a number of requests for better documentation, but we are still waiting to see.

  Surprisingly, one of the best forms of

  "documentation" is by examining the signature file wireless IDS which has a few comments and explains how settings work. You can see what a little enlightening.

  In addition, when it comes to false alarms, we have seen a number of them in various flavors. Here are a few thoughts:

  If you run "containment" or rogue APs, wireless ID system currently interprets its own messages of containment as a false-positive/attack. This is a known bug ( CSCsj06015 ) that says: it is fixed, but to my knowledge continues to be a problem.

  Here is a link to the bug:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj06015

  Also, when some brands of customers go out of scope, a string of messages disassociation is sent via the Russia Federation to ensure that the RF connection is broken. However, the number of these legitimate trusts sometimes exceeds the allowed value in the signature CODES of Cisco Wireless file and the WLC erroneously interprets as a false positive / attack, whereas in fact, it's a normal approval. The number of detections per second value can be adjusted (in fact, the proposed TAC make some changes here - but this really needs to be better set at the factory to prevent them to ancestral). One of the links below explains the methodology to change wireless IDs. The most recent versions of the WCS/WLC are supposed to allow a change of parameter/GUI based these parameters vs export/edition/download the signature file wireless IDS on/in each WLC.

  For your reading pleasure, here are some links that you might find useful who discuss various wrinkles in wireless IDs:

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddf672c/0#selected_message

  http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Expert%20Archive&topic=Wireless%20-%20Mobility&topicID=.ee7f999&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbf522e/16#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbf520e/1#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbeccbc/0#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddfaecb/1#selected_message

  Thank you

  John

  (Don't forget to rate helpful messages)

• IDS signatures

  Hello

  Some exist tool to develop signatures for new protocols in Cisco IDS?

  Thank you

  Leandro.

  I do not exactly understand your question, but here's a link to the documentation about the writing of signatures for the Cisco IDS devices. I hope this helps.

  http://www.Cisco.com/en/us/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00801a0c28.html

• How to interpret error PIX IDS

  Hi all

  For example, I got this error: "all ID files: 6053 DNS request.»

  Where can I know exactly what this and other means of ID messages and what are the ramifications of them and if possible corrective measures.

  Peace

  Roy

  The "6053" in this post (and all messages of type ID in the PIX) is the number of signatures. You can check what it means in seeking to network security database (NSDB) here:

  http://www.Cisco.com/cgi-bin/front.x/CSEC/idsAllList.pl

  Note that the PIX does not check for all these signatures, only a small subset of them in fact.

• Prevention of Spam PIX IDS

  Some firewalls (such as raptors) have a function that will check the incoming IP/domain mail to make sure that the domain name of the sender can be reached (reverse) via the IP address of the sender. This prevents spammers from sending mail to your e-mail with falsified addresses server. PIX it? How about you check sending IPs against block lists? It would be cool. And nachos. Nachos are cool, too.

  Nope, is who does not offer the pix.

  IMHO these functions are better achieved at the level of the server e-mail - this way, the e-mail administrators are more fully accountable for the reception and delivery of emails throughout the org and to the ' net, rather than splitting of responsibilities between the security personnel and email admins

• Integration with the PIX IDS firewall

  I read the Release Notes for Cisco Intrusion Detection System Sensor Version 3.0 S4 (1), and tripped on the new features of this version it pretends the integration with the PIX firewall

  How do implement you this? What kind of integration offer?

  Instructions for the sensor and the basic configuration of PIX can be found here:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids8/13870_01.htm#xtocid23

  Instructions for sensor and PIX SSH configuration can be found here:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids8/13870_01.htm#xtocid16

  You can configure the sensor to connect to the PIX via telnet when

  using the PIX inside interface, otherwise you have to use SSH.

  SSH with 3des encryption is supported in version 3.0 or later

  sensors for connections of PIX.

  Warning: If you use telnet with a version 6.2.1 or PIX more late or if

  you want to use SSH with encryption on any PIX, so you

  need a patch for your sensor. If so, open a case of TAC and demand

  the latest version of nr.managed engineering. Reference

  [email protected] / * / for any question.

• Available to multiple IDS signature appearances?

  My wife and I need digitally sign a Bank document.  The document requires us to both full signatures and original place in several places.  Given that I have received the document in electronic format, I electronically sign documents.

  I use Acrobat 9 Pro on Windows XP 32-bit (my work computer), and I've never used before digital signatures, so I started by creating an ID for myself.  I used the following steps:

  1. I created my ID with my contact information (name, e-mail address, etc.).
  2. I asked a strong password for the signature.
  3. I created an appearance that contained the current date and a JPEG of my signature.
  4. I created a different appearance which contained just my initials.
  5. I created a last appearance which contained just my name.
  6. I saved the key to a PFX file.

  I then started the same steps to create an ID for my wife (on the same Windows account and without close Acrobat).  I thought that when I created a new ID that Acrobat creates an ID without appearances.  Instead, all appearances, I created for my ID was available for the ID of my wife, too.  So, I was able to place a signature to aid ID of my wife but the image was my signature.

  I missed something?  Appearances stored with the ID, and if so, how Acrobat separate them among the ID?  I looked through the help of Acrobat, but the only site that I found one spoke creation of appearances, and he did not work with more than one.

  Any help is appreciated.  Thanks in advance.

  Matthew

  Hi Matthew,

  Acrobat (and when I say Acrobat I mean really both Acrobat and Reader) save the appearances and the digital ID files in the space of the user as assigned by the operating system. If you do not log on when you start the computer (which is just, it starts and you find yourself on the desktop) then there is probably only one user, which was created when you set up the computer. If you have a log on screen when you select a user name and type a password then there is probably accounts for you and your wife. Anyone logged in as this is where the files will be stored. Specifically, I am referring to C:\Documents and Settings\\Application Data\Adobe\Acrobat\9.0\Security where will depend on the journal in the name.

  I hope this helped,

  Steve

• IDS PIX "fat Ping".

  Is it possible to allow ping big answers through the signature of PIX IDS attack without completely turning off the ID?

  Hello

  Use the command 'ip signature verification' to disable this signature

  signature verification IP:

  Specify the message to display, establish a comprehensive policy to a signature and disable or exclude a signature verification.

  I think that the signature is 2151: large ICMP traffic

  Hope this helps,

  Christophe

• Sharing the burden of the IDS/IPS

  Hi experts,

  Since it is possible to implement some IDS features on routers and PIX, along with the ID is, in a network where all 3 of these devices exist, is it interesting to implement some features on routers and PIX IDS?

  And, if so, what factors are to be considered in deciding what signatures are enabled on what device?

  In this type of scenario, which are considered best practices?

  Thank you very much

  It is possible to do what you ask. Note that the signature on the IPS appliance is a bigger, more complete than other devices together. The exact mix depends on your network configuration. I would say a finer granularity of inspection closer you to your network. For example, the PIX can perform basic firewall functions and filter most of the low-level, floods and general port scans probe. Some routers are good for the limitation of the flow, the traffic shaping, etc. Then the IPS can inspect flows coming into this challenge, focusing on all traffic that could hurt you (beyond knocking on your front door of firewall). Of course, this is just a scenario. Some people can't stand not knowing what to try to knock on the front door. Others do not want the hassle of trying to reconstitute the papers from three different pieces of equipment so they put things in different orders, such as IOS IPS, PIX. Another focus of exploration is what device you can use as a blocking device, the PIX or IOS router (or IP addresses in the case of mode inline operation).

  Cisco means the blueprint of network SECURITY as a job, starting point architecture. The entire library of SECURITY white papers can be found here:

  http://www.Cisco.com/en/us/partner/NetSol/ns340/ns394/ns171/ns128/networking_solutions_package.html

• PIX does not allow packets loarge

  I can ping with l - 992, but fail with-l 993.

  Ping 172.16.17.1 with 992 bytes of data:

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

  Ping statistics for 172.16.17.1:

  Packets: Sent = 4, received = 4, lost = 0 (0% loss),

  Time approximate round trip in milli-seconds:

  Minimum = 1ms, Maximum = 1ms, average = 1ms

  Ping 172.16.17.1 with 993 bytes of data:

  Request timed out.

  Request timed out.

  Request timed out.

  Request timed out.

  Ping statistics for 172.16.17.1:

  Packets: Sent = 4, received = 0, lost = 4 (100% loss),

  I also see that attached to the devices in the DMZ are taken excessively long time.

  The MTU size on all interfaces is always the default value of 1500.

  Hi Jimmysturn:

  Which is likely happened here is that you have ID political attack linked to your external interface with the action 'drop' or 'reset' all packages that match the signature in the category of the attack.

  Signature 2151 (large ICMP) will drop packets hit the PIX off interface or those who pass through the PIX outside interface when you ping with large packet size (+ 993 bytes):

  From your post, you must have had the following policy of IDS on your PIX:

  IP audit name attackpolicy attack action fall

  (or

  IP audit name attackpolicy action fall attack alarm

  or

  attack IP audit name attackpolicy raz action alarm

  or both)

  If you want to ping with big package, there are several things you can do:

  (1) remove the policy of "attackpolicy" completely from your external interface. It will turn off all of the IDS signatures in the category of the attack.

  Carefully look at this and see if it's what you want to do.

  To achieve the above, issue the following command:

  "no interface verification ip outside of attackpolicy"

  (2) turn off the signature 2151 by running the command:

  "disable signature verification ip 2151.

  That would disable only the big signing of ICMP attack while leaving the other signatures of attacks in the category of GIS attack ON.

  (3) set signature action to open a session (a syslog server or the internal buffer) large ICMP packets instead of dropping. Again, this should be determined carefully as option 1.

  To achieve the above goal, issue the following command:

  IP audit alarm action name attackpolicy attack

  It will be useful.

  Please indicate the position accordingly if you find it useful.

  Sincerely,

  Binh

• Signatures of MARCH

  Our 50 CS-MARS is 4.2.6. Is it possible to update the signatures thereon?

  Yes, until you reach at least some version of MARCH. And even then, only Cisco IDS signature updates are performed without the upgrade of version.