IDS Signature configuration - Using masks and Flags

Hi all,
It is not clear to me on how to use "mask" and "flags" while editing a signature on IDM. In the wizad, I have the option to select the TCP flags to either fire (TRUE)or NOT to fire (FALSE) the alarm or ignore (Don't Care)the flag. Can someone explain how the mask is used? My understanding about them is;
Mask tells the sensor what flags to monitor. Other flags are ignored.
TcpFlag tells the sensor to fire the alarm, if that particular flag is set.
Say for example; I select SYN and ACK in the mask and only SYN in the TcpFlag. This means, the signature will fire only if SYN is set in the packet. If ACK is also set in addition to SYN, then the sig will not fire. This is equal to setting the SYN to TRUE; ACK to False and all other flags to DON'T Care. Am I correct?
Thanks in advance,
Mohan

You are correct.
By setting Mask to SYN and ACK it will ignore the other flags.
By setting TcpFlag to SYN the signature will trigger if the packet has a SYN, but will not fire if it also has an ACK.
So a SYN packet will trigger it.
A SYN ACK packet will Not.
An ACK packet will Not.
A RST packet will Not.
etc..
However, be aware that a SYN with a combination of any other flag besides ACK WILL trigger it.
So a SYN RST will trigger it.
A SYN FIN will trigger it.
A SYN RST FIN PSH will trigger it.
etc...
This is because the signature will only look to ensure the SYN is present and the ACK is not present.
So the signature will trigger on a traditional SYN to open a connection, but will also trigger on these other weird combinations that are not part of a normal TCP connection.
So if you want to limit it to firing only on real SYN packets, then go ahead and list all the flags in the Mask and only SYN in the TcpFlags. This will ensure the signature triggers on only packets with the single SYN flag.

Similar Messages

Database standby configuration using Intel and Risk processors

Hi
We are planning to configure a standby database, but we want to use a DELL 2950 server with processors Intel. Our primary database version is Oracle RAC 10gR2 10.2.0.3 64 bits (the standby server has the same oracle version) with two nodes using IBM P550 boxes with processors P6 (RISK) server. Both databases (primary and standby databases) have Linux Red Hat 4 – 64 Bits. But I don’t know if is possible to make this configuration, could you tell me about it.
Thanks

Thanks a lot for your help.
I’ll start with the configuration. Our client decided to use that server (Intel proccesor) as standby server, he knows the possible performance degradation

How to use copyPixels and mask some places?

I've two images with the same size (49 x 90), they both are 8-bit depth. The first image has a purple backgroud color, the other one has a background color rgb(0, 255, 0) which is true green.
The first image has a pixel doll with huge hair on her head, the other one has a drawing of pretty small hat around which I've some space filled with red color. The idea is two place the hat image over the doll with huge hair image with copyPixels method, make the background of hat image transparent while copying and use the red filled places as a mask so that after copying the hat would be on the dolls head and the hair which is going out of the hat, if you understand what i mean, is hidden so that it would look that doll has her hair in the hat. Get the idea?
member("two").image.copyPixels(member("one").image, member("one").rect, member("one").rect, [#bgcolor: rgb(0, 255, 0) , #ink: 36])
I got it this far that the background is transparent, but I the mask and matte stuff just doesn't make any sense to me. I can't figure out how to make the red filled places works as a mask to hide the hair after copying. Any help?

Hi,
answers to your q's
1. You can only write where clause on BMM layer by using content tab from the properties of the source object. You cannot write SQL statments on BMM layer.
Two way to use MV.
1. configure your oracle db to use query rewrite, this way you can use base fact objects and Oracle will rewrite the query when you create a request on analytics.
2. Expose MV on Physical layer, treat MV as Fact object and create join with all the dim objects u want to and configure you BMM layer.
3 . File Menu and you will find option.
Thanks
Girish

[BUG]PS CC Layer Group add vector mask and disable it,use path selection tool click,always crash!!!

[Bug] Photoshop CC，Layer Group add vector mask and disable it, use path selection tool click canvas, always crash!!! Please help me!
The sample psd file(158KB):
http://doc.aoyea.com/ps_cc_bug.psd
My Computer configuration:
SONY VAIO CA100 Notebook、Intel Core I5 2410 CPU、16GB RAM、AMD Radeon 6600M(1G RAM)、Windows7 x64 SP1(clean)、Scratch disk free space is 100GB
email: [email protected]

Hi,
As far as i know that's a bug that will hopefully be fixed in the next update to photoshop cc.

Why use layer masks and adjustment layers?

I've been using PSE and CS successfully for years.
One thing I have never understood is: why use layer masks and adjustment layers, instead of simply creating a copy of the subject layer (the one I want to make changes to) and experimenting with that? It's quick (Ctrl-J), I can do it as many times as I want, I'm not affecting my Background layer. If I like the changes, I can keep them. I can switch the copy on and off to compare with the Background layer. I can do any type of blend or combination I desire. I can insert Gradient layer(s), select any part of the copy and (Ctrl-J) create a new layer containing only the selected part. I can adjust size, rotate, do anything.
It almost seems that "layer mask" and "adjustment layer" are mainly another layer of terminology; can anyone explain (preferably in 50 words or less) how they are intrinsically different from or superior to working with copies of the Background layer? What can be done with them that can't be done simply using copies of the Background layer?

Here's a very basic example of the advantage of using a layer mask.
I have this picture of a sunflower and I want to convert the background to black & white, leaving just the flower in color. I duplicated the Background layer, converted it to B&W and proceeded to use the Eraser to uncover the flower color. But I made a mistake and erased outside the flower. There is no way to correct this other than deleting the layer and starting again.
Now let's use a layer mask on the B&W layer. Set the Foreground/Background colors to the defaults black/white. Using the Brush tool paint on the mask with black to reveal the color. Here I painted too far, revealing a green leaf in the background. No need to start over. Simply switch to white and paint the excess to convert back to the B&W.
Tip: while painting you can type "X" to toggle between black and white.
You could also select the flower using the various selection tools and then fill the selection with black. If it turns out the selection was not 100% accurate you can then fine-tune the result by painting on the mask with black or white as necessary.

Configure CRS2008 to using AD and Kerberos with Java application servers.

Hi All,
I have configure CRS2008 to using AD and Kerberos with Java application servers. Domain Controller is installed on W2K3 Server. In addition, CRS2008 is installed on another W2k3 Server.
I have create service account in domain controller: CMSACC
I have create two user account: CRuser1 and CRuser2
I have create domain group: CRSGroup
After I had run the setspn in domain controller,I got the message at below:
Registered ServicePrincipalNames for CN=CMSACC, OU=TEST, DC=BD, DC=com:
    BOBJCentralMS/BDMGTSRV.BD.com
CMC Setting:
AD Administration Name: BD\administrator
Default AD Domain: BD.com
Add AD Group(Domain\Group): secWinAD:CN=CRSGroup,OU=TEST,D=BD,DC=com
Service principal name:BOBJCentralMS/CMSACCatBD.com
I have create a WINNT folder in root directory.Moreover and save bcsLognin.conf and Krb5.ini at here.
bscLogin.conf:
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
krb5.ini:
[libdefaults]
default_realm = BD.com
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
forwardable = true
BD.com = {
default_domain = BD.com
kdc = BDMGTSRV.BD.com
I have tested the Kerberos,using kinit CMSACCatBD.com password, and got error message at below:
Exception: krb_error 41 Message stream modified (41) Message stream modified
KrbException: Message stream modified (41)
        at sun.security.krb5.KrbKdcRep.check(KrbKdcRep.java:53)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:96)
        at sun.security.krb5.KrbAsRep.getReply(KrbAsRep.java:486)
     at sun.security.krb5.KrbAsRep.getReply(KrbAsRep.java:444)
     at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:310)
     at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:259)
     at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:106)
My problem is failed to logon CMC and infoview and got error message at below:
Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserNameatDNS_DomainName, and then try again.
Actually, I am sucessful to logon Business View manager with CRuser1. However, I fail to logon CMC and infoview and got the above error. Have you any suggestion to solve this problem?
Ken.

if you can logon with client tools then that should be an indication that the service account running the CMS IS working! Good news.
So the problem is likely with the java portion (krb5/bsclogin or java options)
If the files are in c:\winnt\ (if not copy them there) and perform c:\program files\business objects\javasdk\bin\kinit username
then enter and password/enter again
Probably get the same message. To note in your krb5.ini all domain info must be in CAPS (the .com appears to be in lower case)
kinit works with just the krb5.ini, java SDK and AD (removing BO config and the service account from the picture). Once that works if your java options are specified properly you should be able to login to CMC/infoview.
also 1 last point. Add udp_preference_limit = 1 to the krb5 lib defaults section
libdefaults
default_realm = BD.com
dns_lookup_kdc = true
dns_lookup_realm = true
udp_preference_limit = 1
Regards,
Tim

I pick a photo, make a copy, add a mask and when I use a brush nothing happens to the mask or the picture. White or black?

I pick a photo, make a copy, add a mask and when I use a brush nothing happens to the mask or the picture. White or black.

If I understand you correctly, you have
Opened an image, and copied the background layer.
Added a layer mask, and finding that painting in the mask makes no difference whether you paint with black or white.
That is what you would expect to happen if both layers are identical. To demonstrate, make a change to the copied layer. Either change the blend mode to Multiply, or lower the opacity, or paint big red stripes across it. Now when you paint with black, the red stripes will disappear where the mask is black, and be visible where the make is white.

Hi, i am trying to smoothskin in photoshop cs6 and when i add a layer mask and try to use my paintbrush nothing apears to happen? help please

Hi there, Im using photoshop cs6 and i have been trying to smooth skin. i have been duplicating the layer and choosing overlay in the blend drop down, then choosing filter, other, highpass, raduis of 9px then inverting the layer then i add a layer mask using alt and clicking the layer icon mask and then it tells me to use a soft brush to to paint over and revel the high pass layer but nothing is happening when i try to use the paint brush? can you help please? thanks Olivia

Using Mattes and Masks to add real mouths to stop frame animation.

Hi all, I'm new to Final Cut Pro, having only really used Avid on PC in the past. I'm currently studying animation in my third year at university and I seem to have hit a stumbling block.
Basically I have created a short stop frame animation featuring various characters, movements and shots etc. From here I would like to be able to add 'real' mouths to those characters (by means of filming the lips/mouths of my voice actors in video format and super imposing them). So here's where it gets complicated (for me at least!).. Whilst I have read that it is possible to overlay sections of video upon original video using Mattes and Masks I haven't been able to find any instructions as to how I would be able to accomplish this with images which are moving around the screen (I.E. I would need to add a mouth to a character who is walking along a road, from left to right, and so I would need to be able to manipulate the location of the mouth so that it was always located over my characters face). I hope that my question makes some sense , I wont get my hopes up for a resolution, but this seems to be quite a busy board and I've managed to pick up a few tips from here recently so hey, worth a shot .

Forgot to mention that you'll have to keyframe the mask to move as well.
If the speach shots are not moving then you have definately made things much simplier for yourself.
For a simple example of keyframing. (Don't blame me if I confuse you further)
Load a clip in the viewer. (make sure that you have the canvas set to IMAGE and WIREFRAME.
Click the MOTION TAB in the viewer. Each of the Basic Motion attributes can be controled individually over a period of time. This is done by placing keyframes on the timeline to the right of each attribute.
Place the playhead (in the canvas) at the start of your clip, then press the round button in the Centre attribute section. The black dot added to the timeline is your first keyframe.
Now move the playhead further down the timeline and press the round button in the Centre attribute section again. Now click the imag in the Canvas and drag it to the right.
Now when you play the clip the shot will move left to right, one keyframe to the next.
That's it in a very small nutshell. And remember, almost any effect or motion can be keyframed.
rh

Hi i m using 4s and its updated but i cant configure with microsoft exchange for my gmail account. Anytime i tried to configure it the message comes connection to the server failed. Pls help me out.

Hi i m using 4s and its updated but i cant configure with microsoft exchange for my gmail account. Anytime i tried to configure it the message comes connection to the server failed. Pls help me out.
<Email Edited by Host>

Discontinued by Google. Read here:
http://googlesystem.blogspot.com/2012/12/google-sync-discontinued-for-gmail.html

I was able to create a digital signature for someone else and use it. How is that protected??

I was able to create a digital signature for my boss who's on vacation using his email address. I figured when I used the signature he would get some sort of email confirmation letting him know, but he got nothing. So it seems like I could create a signature for anyone and use it on any document without their knowledge. What's the protection against anyone creating a signature for anyone else and using it whenever?? Am I missing something??

A digital signature can not be used to verify someone's identity. I can create a signature using anyone's name and email address. In fact, those things are irrelevant to the signature. The only thing that matters is the key used to create it, and therefore to verify it.

HT204053 Can I have 4 apple IDs under one purchasing account for using iMessage and FaceTime?

I have an iPhone, an itouch, an iPad and my kids each have an itouch as well as my bf who has an iPad mini. Is there a way that we can use iMessage and FaceTime with each other? All devices use one account for purchases. Can we each have an ID without losing our music and movies?

Thank you for the reply... But now, I have to ask, HOW?! Lol I have added and verified their emails, but I don't think that's the same is it? I basically need step by step instructions. Maybe I just missed it, but I have searched how to do this and can't figure it out. So any help would be greatly appreciated... We each have a couple hundred various songs and movies etc downloaded, but all registered and synced to my account and I really don't want to have to buy duplicates of one direction, Taylor Swift, etc. ☺ so to anyone who can give me a hand... Thank you in advance.

How to configure use of Ethernet and wireless simultaneously, with different Windows´s?

Hello friends,
My network has two Win XP-laptops connected via ethernet to a Dovado-router, and from the Dovado-router another ethernet cable to a Win 7 PC.
The Win 7 PC connects to the internet via a D-Link wireless network to my ISP wireless router Huawei E589.
Problem: the PC refuses to work with both ethernet and wireless at the same time.
I use the ethernet for tranferring vast amounts of graphical data (astronomy photographs at 3-4 GB each), and I can only access the internet through the wireless. Neither XP nor 7 wizards are able to fix it. Both networks were visable in Network Center,
now only the wireless is available. Ethernet is gone.
What do I do, to make it work?

Hi,
What's your purpose? My understanding is that you want Windows 7 PC wireless use internet and wired use Lan. If I am misunderstand please point me fault.
For the situation you can do like this:
1) Setting for your both routers.
Make sure both routers have different Router IP's and SUBNETS, you should try to set the subnet of Dovado-router to 255.255.255.252(this router should be used as local Lan, not connect to internet).
Set the subnet of D-link to 255.255.255.0
2) Setting For the LAN adapter.
Under the TCP/IP properties(Lan adapter), please assign a unique IP address (which coincides with the subnet of Dovado-router ), set the subnet to 255.255.255.252 (or whatever you set it to Dovado-router). The very important things is that
don't assign any GATEWAY to Lan adapter, leave it blank.
3) Setting For the WIRELESS adapter.
Under TCP/IP properties(wireless adapter), please assign a unique IP address (that coincides with the wireless router), set the subnet to 255.255.255.0 (or whatever the default is for the wireless router), and make sure to type gateway IP address ( D-link
IP address).
Now you can test if they are work normally.
Hope this helps.
Regards.
Spencer
TechNet Community Support

How to copy configuration files to and from the cisco ios routers that use SNMP

Hello,
I went on the page : https://supportforums.cisco.com/docs/DOC-1860
You explain how to get a config file and send it to a tftp server or oppositely.
I face this problem:
id090365:~> snmpset -v2c -c communitystring hostipaddress .1.3.6.1.4.1.9.9.96.1.1.1.1.2.98 i 1
Error in packet.
Reason: noCreation (That table does not support row creation or that object can not ever be created)
Failed object: SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.2.98
Do you have any idea?
Thanks,
Olivier

I hadn't seen any snmp guides using snmpv3 and scp as transport protocol. For those looking to implement, here is what worked for me.
As with the other snmp config copy guides you will need to download the respective MIBS and load them in the snmp.conf file.
This post will specifically cover the snmpset commands for a v3 setup.
SNMP Environment:
Name        : net-snmp
Version     : 5.7.2
Release     : 17.fc20
snmp conf file in ~/.snmp/snmp.conf
   contains
defSecurityName XXX <- replace with v3 username
defContext ""
defAuthType SHA
defPrivType AES
defSecurityLevel authPriv
defAuthPassphrase ***** <-replace with authentication pass
defPrivPassphrase ***** <-replace with encryption pass
defVersion 3
showMibErrors no
mibs ALL
I would verify basic snmpv3 functionality with a snmpwalk of something simple like sysUpTime. When that's good proceed to the CONFIG-COPY snmp commands.
This is my bash script that does the entire copy asking only for a single argument of IP/Hostname of the device being backed up. The 2>/dev/null shown in the script or at the cli below redirects STDERR to null to avoid the MIB modules parsing errors.
#!/usr/bin/bash
DEVICE=$1
RANNUM=42
USER=******
PASS=******
SERVER=X.X.X.X
DATE=$(date +"%m_%d_%y")
snmpset $DEVICE ccCopyProtocol.$RANNUM i 4 ccCopySourceFileType.$RANNUM i 4 ccCopyDestFileType.$RANNUM i 1 ccCopyServerAddress.$RANNUM a "$SERVER" ccCopyFileName.$RANNUM s "$DEVICE.$DATE" ccCopyUserName.$RANNUM s $USER ccCopyUserPassword.$RANNUM s $PASS ccCopyEntryRowStatus.$RANNUM i 4 2>/dev/null
Once run you can check the status of the copy with the following command.
[root@localhost hlsb]# snmpwalk sbs-tech-switch ciscoConfigCopyMIB 2>/dev/null
CISCO-CONFIG-COPY-MIB::ccCopyProtocol.42 = INTEGER: scp(4)
CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.42 = INTEGER: runningConfig(4)
CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.42 = INTEGER: networkFile(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.42 = IpAddress: 10.10.10.193
CISCO-CONFIG-COPY-MIB::ccCopyFileName.42 = STRING: sbs-tech-switch.07_09_14
CISCO-CONFIG-COPY-MIB::ccCopyUserName.42 = STRING: XXXX
CISCO-CONFIG-COPY-MIB::ccCopyUserPassword.42 = STRING: XXXX
CISCO-CONFIG-COPY-MIB::ccCopyNotificationOnCompletion.42 = INTEGER: false(2)
CISCO-CONFIG-COPY-MIB::ccCopyState.42 = INTEGER: successful(3)
CISCO-CONFIG-COPY-MIB::ccCopyTimeStarted.42 = Timeticks: (52270199) 6 days, 1:11:41.99
CISCO-CONFIG-COPY-MIB::ccCopyTimeCompleted.42 = Timeticks: (52270339) 6 days, 1:11:43.39
CISCO-CONFIG-COPY-MIB::ccCopyEntryRowStatus.42 = INTEGER: active(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddressType.42 = INTEGER: ipv4(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddressRev1.42 = STRING: "10.10.10.193"
After the successful copy completes the entry will exist for five minutes allowing for no further requests to be made with that particular random number. To send another request prior to the five minute clearing of the table send a "destroy" snmpset to clear the entry.
[root@localhost hlse]# snmpset sbs-tech-switch CISCO-CONFIG-COPY-MIB::ccCopyEntryRowStatus.42 i 6 2>/dev/null
CISCO-CONFIG-COPY-MIB::ccCopyEntryRowStatus.42 = INTEGER: destroy(6)
Hope this will save some time for those looking to implement a more secure snmp config copy setup.
V/R
Cody Hartley

Best Practise for WLC IDS Signature Thresholds

Hi, are there any best practices for WLC IDS Signature thresholds?
Thanks!
KR,
Rena

You can configure IDS signatures, or bit-pattern matching rules used to identify various types of attacks in incoming 802.11 packets, on the controller. When the signatures are enabled, the access points joined to the controller perform signature analysis on the received 802.11 data or management frames and report any discrepancies to the controller. If an attack is detected, appropriate mitigation is initiated.
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-5/config_guide/b_cg75/b_cg75_chapter_0111110.html#d162818e187a1635

IDS Signature configuration - Using masks and Flags

Similar Messages

Maybe you are looking for