Force10 Networks PSeries 100-00055-01 Instrukcja Użytkownika Pobierz pdf (Strona 121)

P-Series Installation and Operation Guide, version 2.3.1.2 121

ttl This keyword checks for the specified IP time-to-live

value.

ttl: [number {>|<|=} | number- |

{-|>|<|=}] number;

uricontent Searches the normalized request URI field for the

specified content.

data_string can contain mixed text and binary data.

Binary data is enclosed within pipe characters and is

written in hexadecimal form.

uricontent: [!] “data_string”;

Table 28 Description of P-Series Snort Keywords

Keyword Description Rule Syntax

1 2 ... 116 117 118 119 120 121 122 123 124 125 126 ... 131 132

P-Series Installation and 1
Operation Guide 1
Contents 3
Appendix E 6
Appendix F 6
Preface About this Guide 7
Information Symbols 8
Related Documents 8
Additional Resources 8
Chapter 1 Installation 9
System Specifications 10
Physical Connections 10
Configuration 12
Security Check 12
Upgrading Software 12
Chapter 2 Getting Started 15
16 Getting Started 16
Chapter 3 Introduction 17
Types of Rules 18
Sample Rules and Firmware 18
Rule Management 19
Deploying the P-Series 19
Inline Deployment 20
Fail-safe Deployment 20
Highly-available Deployment 21
Passive Deployment 21
Capturing Matched Traffic 22
Capturing to a Host CPU 23
Mirroring to Another Device 24
GUI Commands 26
PNIC0 Not Active 27
To modify dynamic rules: 29
30 Graphical User Interface 30
Figure 16 30
Figure 17 30
Capture/Forward Policies GUI 30
Runtime Statistics 31
32 Graphical User Interface 32
Figure 19 32
Figure 20 32
Reloading Firmware 33
34 Graphical User Interface 34
(see Appendix A , on page 36
Monitoring System Performance 38
Managing Firmware Images 39
40 Web-based Management 40
Managing Policies 41
42 Web-based Management 42
Sguil Server 43
Sguil Clie 43
P-Series Sensors 43
Installing the Sguil System 44
Installing the Sguil Client 45
Installation Files 46
Running the Sguil System 47
Running the Sguil Server 48
Running the Sguil Client 49
Figure 33 appears 50
CLI Commands 51
MAC Rewriting 51
Removing VLAN Tags 53
54 Command Line Interface 54
Chapter 8 Compiling Rules 55
Enter command gmake from 58
Selecting Yes is recommended 59
Summary of configuration 60
Firmware Filenames 62
Compiler Errors 62
Chapter 9 Writing Rules 63
Protocol 64
Source Addresses 64
Direction Operator 65
P-Series Rule Syntax 66
Writing Stateful Rules 68
Stateful Rule Examples 70
Handling Segmentation Evasion 71
Anomalous TCP Flags 73
74 Writing Rules 74
Chapter 10 Firewall 75
Enabling the Firewall 76
90 Appendix A 90
Figure 55 91
92 Appendix A 92
Figure 56 92
Disable the physical link 93
[channel] 93
Enable the physical link 93
Information 95
0/pnic_{0 98
[number] 103
[number] 104
• Stop capturing and matching 104
Stop the Sguil sensor 107
• Load the runtime parameters 110
[root@localhost SW]# 112
114 Appendix A 114
Stop the web server 116
Related 117
Commands 117
118 Appendix A 118
Appendix B Snort Keywords 119
122 Appendix B 122
Table 30 123
124 Appendix C 124
Unix Commands 125
Appendix E Glossary 127
Appendix F Technical Support 129
Step Task 131
132 Technical Support 132

Komentarze do niniejszej Instrukcji

Brak uwag

Force10 Networks PSeries 100-00055-01 Instrukcja Użytkownika Strona 121

Komentarze do niniejszej Instrukcji