Force10 Networks PSeries 100-00055-01 Instrukcja Użytkownika Strona 123
- Strona / 132
- Spis treści
- BOOKMARKI
Oceniono. / 5. Na podstawie oceny klientów
P-Series Installation and Operation Guide, version 2.3.1.2 123
The meta and evasion rules for Channel 0 and Channel 1 are the same. They are listed in Table 29 and
Table 30.
Appendix C Meta and Evasion Rules
Table 29 meta Rules for Channel 0 and Channel 1
meta Rules
alert tcp any any -> any any (msg:"Z SYN"; flags:S,12; S:1; R:2; C:3;)
alert tcp any any -> any any (msg:"Z SYNACK"; flags:SA; S:1; R:2; C:5;)
alert tcp any any -> any any (msg:"Z TCP within was issued previously for this flow = capture flow"; S:32; R:2;
C:32;)
alert udp any any -> any any (msg:"Z UDP within was issued previously for this stream = capture stream"; S:64;
R:2; C:64;)
alert tcp any any -> any any (msg:"Z SAPU TCP Flags"; flags:SAPU;)
alert tcp any any -> any any (msg:"Z FU TCP Flags"; flags:FU;)
alert tcp any any -> any any (msg:"Z PF TCP Flags"; flags:PF;)
alert tcp any any -> any any (msg:"Z UP TCP Flags"; flags:UP;)
alert tcp any any -> any any (msg:"Z Zero TCP Flags"; flags:0;)
Table 30 Evasion Rules for Channel 0 and Channel 1
Evasion Rules
alert tcp any any -> any any (msg:"Z Evasion: State 2 Fragment of size 1 "; dsize: 1; S:4; R:1; C:16;)
alert tcp any any -> any any (msg:"Z Evasion: State 1 First fragment of size 0 <> 10 = state 1"; dsize: 0 <> 20; S:4;
R:1; C:8;)
alert tcp any any -> any any (msg:"Z Evasion: State 2 Second fragment of size 0 <> 10 = capture flow"; dsize: 0
<> 20; S:8; R:1; C:16;)
alert tcp any any -> any any (msg:"Z Evasion: State 3 Capture flow fragments of size 0 <> 10"; dsize: 0 <> 100;
S:16; R:2; C:17;)
- P-Series Installation and 1
- Operation Guide 1
- Contents 3
- Appendix E 6
- Appendix F 6
- Preface About this Guide 7
- Information Symbols 8
- Related Documents 8
- Additional Resources 8
- Chapter 1 Installation 9
- System Specifications 10
- Physical Connections 10
- Configuration 12
- Security Check 12
- Upgrading Software 12
- Chapter 2 Getting Started 15
- 16 Getting Started 16
- Chapter 3 Introduction 17
- Types of Rules 18
- Sample Rules and Firmware 18
- Rule Management 19
- Deploying the P-Series 19
- Inline Deployment 20
- Fail-safe Deployment 20
- Highly-available Deployment 21
- Passive Deployment 21
- Capturing Matched Traffic 22
- Capturing to a Host CPU 23
- Mirroring to Another Device 24
- GUI Commands 26
- PNIC0 Not Active 27
- To modify dynamic rules: 29
- 30 Graphical User Interface 30
- Figure 16 30
- Figure 17 30
- Capture/Forward Policies GUI 30
- Runtime Statistics 31
- 32 Graphical User Interface 32
- Figure 19 32
- Figure 20 32
- Reloading Firmware 33
- 34 Graphical User Interface 34
- (see Appendix A , on page 36
- Monitoring System Performance 38
- Managing Firmware Images 39
- 40 Web-based Management 40
- Managing Policies 41
- 42 Web-based Management 42
- Sguil Server 43
- Sguil Clie 43
- P-Series Sensors 43
- Installing the Sguil System 44
- Installing the Sguil Client 45
- Installation Files 46
- Running the Sguil System 47
- Running the Sguil Server 48
- Running the Sguil Client 49
- Figure 33 appears 50
- CLI Commands 51
- MAC Rewriting 51
- Removing VLAN Tags 53
- 54 Command Line Interface 54
- Chapter 8 Compiling Rules 55
- Enter command gmake from 58
- Selecting Yes is recommended 59
- Summary of configuration 60
- Firmware Filenames 62
- Compiler Errors 62
- Chapter 9 Writing Rules 63
- Protocol 64
- Source Addresses 64
- Direction Operator 65
- P-Series Rule Syntax 66
- Writing Stateful Rules 68
- Stateful Rule Examples 70
- Handling Segmentation Evasion 71
- Anomalous TCP Flags 73
- 74 Writing Rules 74
- Chapter 10 Firewall 75
- Enabling the Firewall 76
- 90 Appendix A 90
- Figure 55 91
- 92 Appendix A 92
- Figure 56 92
- Disable the physical link 93
- [channel] 93
- Enable the physical link 93
- Information 95
- 0/pnic_{0 98
- [number] 103
- [number] 104
- • Stop capturing and matching 104
- Stop the Sguil sensor 107
- • Load the runtime parameters 110
- [root@localhost SW]# 112
- 114 Appendix A 114
- Stop the web server 116
- Related 117
- Commands 117
- 118 Appendix A 118
- Appendix B Snort Keywords 119
- 122 Appendix B 122
- Table 30 123
- 124 Appendix C 124
- Unix Commands 125
- Appendix E Glossary 127
- Appendix F Technical Support 129
- Step Task 131
- 132 Technical Support 132
© 2020, manymanuals.pl. Wszelkie prawa zastrzeżone. | 0.035 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Komentarze do niniejszej Instrukcji