IDSM-2 (7.0.2) want it to monitoring traffic and not affect anything

Hello All,
I am pretty new to IDSM's, just trying to learn about them. I am working on a production network so I'm having to be pretty careful..
We have 2 X 6513 with two IDSM-2 installed in each which have just been upgraded to 7.0.2. They are all in promiscuous mode and we are using VACLS to redirect traffic to them for checking, I want to ensure there is no way that the production traffic can be affected, I can see most of the actions that affect traffic require the IDSM's to be working in INLINE mode.
The action I was worried about was the TCP RESET, from what I read it seems that this is sent from the management interface of the device and I believe (I may not be correct) that this is available both in inline and in promiscuous mode. Can anyone confirm if this is correct, is the TCP RESET available in PROMISCUOUS mode and if it is how do I turn it off. Currently we only want the devices to monitor and then move to the more advanced features after we get a better understanding of our network.
P.S. Could anyone suggest a good document on how to go about managing and making use of the amount of alerts, and also IDSM setting up and tuning in general..
Any help anyone could give would be gratefully appreciated.
Thanks in advance.

The action that you specify on each signature defines the action taken. When in promiscuous mode (IDS), actions like drop inline etc will not be available. The best way to go about what you want is to set all your signatures to just fire alerts when they trigger. Some signatures will have actions like tcp reset but if you sort from the action column in the IDM you can easily find these and remove the action and rather just produce alert for it instead. This will allow you to tweak your IDS before applying it inline (IPS) if that is your goal.
Be aware also that the IDS will baseline your network and the Anomaly Detection module will act a little crazy if you don't let it monitor your network for 1-2 days of normal traffic.

Similar Messages

HT1766 # is not working in my iphone 4s, when i want to see how much credit i have in iphone, i need to put # on that, than it calls and end, it is not working and not showing anything..

# is not working in my iphone 4s, when i want to see how much credit i have in iphone, i need to put # on that, than it calls and end, it is not working and not showing anything..

http://support.apple.com/kb/HT1848 Did you transfer your purchased item, take a look at the link

I want to store my mac before I go south for the winter. I don't want to lose my info. Can I remove battery and not lose anything?

I want to store my mac before I go south for the winter. I don't want to lose my info. Can I remove battery and not lose anything?

Yes. Your data are stored in your hard drive, and the battery is not required for the hard drive to keep its data.
However, you may want to google for information about how to store a battery for an extended period - "winter" is a long time, and batteries do run down when left sitting on a shelf.

HT4718 I have an external hard drive that I used as Time Machine Backup. I have not used it for a while and now, when I plug it in computer says: This disc is not readable. I want to recover the backups and not erase and reformat the disc. Thank you in

I have an external hard drive that I have used as Time Machine backup, but not for a while. Now when I plug it in, computer says this disc is not readable.
I want to keep the backups on it and not erase and start over.
Thank you in advance.
Gregor

It sounds like something went wrong with the drive. Did you drop it? How long has it been sitting around unused?

I want to download my files and Not participate in Revel

Is there anyway for me to download pictures to computer and not participate in Revel?? Need instructions...

When the first emails went out, you were given the option to opt-out, but the option to opt out has passed. All remaining accounts will be migrated between now and June.
Migration is just copying jpg files to Revel. They are still in Photoshop.com until June, so you can use our media downloader to archive them to your computer. Follow this link to see how:
FAQ: How do I archive my Photoshop.com files with the Adobe Media Downloader ?
http://forums.adobe.com/thread/1174289?tstart=0
I hope that helps. You might want to give Revel a try since your files will be there and the first 30 days you get unlimited uploads.
Pattie

I want to download Firefox, but NOT have it as default browser, and not affect other users on the computer - is this possible?

I want to install Firefox, and be able to use it on demand, whilst retaining Internet Explorer as default browser. Will I be able to use either browser as and when I wish?
Thanks, and sorry for being stupid!

Hi Tony,
Thanks a lot - I thought that was the case, but needed to check!
Will McAfee security talk to Firefox ok? Site Advisor etc?

Why you want to be on 11g and not 10g on your Siebel upgrade large database

Hi All,
Just realized the issue of adding new non nullable columns that normally is a huge issue on Siebel upgrades should go away with 11g since the way this is handled is totally changed. Other than tables like s_audit_item which has a CLOB column should allow these columns to be added very fast.
This is good reason to go with 11g instead of 10g if you are upgrading Siebel.
When you add a column, the initial value of each row for the new column is null. If
you specify the DEFAULT clause for a NOT NULL column, then the default value is
stored as metadata but the column itself is not populated with data. However,
subsequent queries that specify the new column are rewritten so that the default value
is returned in the result set.
This optimized behavior differs from earlier releases, when as part of the ALTER
TABLE operation Oracle Database updated each row in the newly created column with
the default value, and then fired any AFTER UPDATE triggers defined on the table.
However, the optimized behavior is subject to the following restrictions:
■ The table cannot have any LOB columns. It cannot be index-organized, temporary,
or part of a cluster. It also cannot be a queue table, an object table, or the container
table of a materialized view.
■ The column being added cannot be encrypted
Robert Ponder
Lead Architect and Director
Ponder Pro Serve
cell: 770.490.2767
fax: 770.412.8259
email: [email protected]
web: www.ponderproserve.com

Ok well you need to get your facts straight. You say the reason to upgrade to OS 4 but half of these have to do with the new iPhone 4 and not the OS. Two totally different issues

Am buying a phone for my gf and want it shipped to her and not me, pls tell me how to?

Hey!I am buying a phone for my gf, she lives in US, and I in Canada.Pls tell me how to pay with my account but ship to her.Thank you

You can add her address as a 'Gift Address' for exactly this reason.This protects the seller as well as you and your friend. It would be polite to let the seller know, if you do win, why your eBay address and your PP address do not match in this instance.

HT204406 I am using iTunes Match and want to "uncheck" songs so that I can use my shuffle and not hear every song in my itunes.

Can I "uncheck" songs in my iTunes while using iTunes Match? I want to use my shuffle and not hear every song in my itunes. I use a MacBook Pro, iphone 4S and an ipad.

I know of no way to do this.
Itunes ringtones are for iphones.

How can i save my individual playlist on itunes on my external hard drive because i want to buy a laptop and install itunes and move all my music and playlist thats on my desktop to my laptop and almost all my music is from a bunch of cd's i own

how can i save my individual playlist on itunes on my external hard drive because i want to buy a laptop and install itunes and move all my music and playlist thats on my desktop to my laptop and almost all of my music is from a bunch of cds i own

Hello ryane84
The easiest and most efficient way to copy your music is to follow the steps under the External drive section. Make sure that you have organized the iTunes library first before you copy it over. Then put the copied iTunes folder in the same Music folder on your computer.
iTunes: How to move your music to a new computer
http://support.apple.com/kb/ht4527
Regards,
-Norm G.

What is difference between I-mesage and Text Message, some I want to send I message and but I send text and it's charge to me

What is difference between I-mesage and Text Message, some timeI want to send I-message and but I send text and it's charge to me.

Thanks Wj,
another question, how I got to know, my I-message is activated, I put as ON, but I am not getting mesage it's activated, there is link showing to me, learn more abount I-message. do it will take time? please advise how I can activate my I-message. Please advise.

Trying to sync iPod with library, but receive this message, "The iPod is synced with another itunes library. Do you want to erase this ipod and sync with this itunes library". I do not want to erase my iPod... Any suggestions?? Please help!!

Trying to sync ipod with itunes library, but I keep getting this message, " The ipod is synced with another itunes library. Do you want to erase this ipod and sync with this i tunes library?"
I do not want to erase my ipod!!! Any suggestions?? please help!

Another way. You can use a USB flash drive & the camera connection kit.
Plug the USB flash drive (works the same with an SD card) into your computer & create a new folder titled DCIM. Then put your movie/photo files into the folder. The files must have a filename with exactly 8 characters long (no spaces) plus the file extension (i.e., my-movie.mov; DSCN0164.jpg).
Now plug the flash drive into the iPad using the camera connection kit. Open the Photos app, the movie/photo files should appear & you can import. (You can not export using the camera connection kit.)
Using The iPad Camera Connection Kit
http://support.apple.com/kb/HT4101
 Cheers, Tom

I have itunes set up on a PC with all my music, apps, etc. I want to stop using PC and move my iTunes and files to a Mac I bought and synch my iPhone with the Mac. Can I just synch iPhone with Mac iTunes and will it copy all my stuff onto Mac, or will I h

I have itunes set up on a PC with all my music, apps, etc. I want to stop using PC and move my iTunes and files to a Mac I bought and synch my iPhone with the Mac. Can I just synch iPhone with Mac iTunes and will it copy all my stuff onto Mac, or will I have to copy files from PC onto Mac?

Here are some of the links to get you started.
https://discussions.apple.com/thread/3727530?start=0&tstart=0
http://support.apple.com/kb/HT4527
http://www.macworld.com/article/1146958/move_itunes_windows_mac.html

HP Photosmart 6510 e-All in One Series I want it to print off my PC in just Black and not Colour?

Please help! I have been in to settings for the printer on my Lap-top and can not find anywhere that will allow me to adjust to just printing in Black and White when I need it and not Colour all the time, which it is doing!

Hi @Anna11,
Welcome to the HP Forums!
I understand that you are trying to print in black only instead of color with your HP Photosmart 6510. I am happy to help with changing these settings!
For further assistance, I will need to know some more information:
If you are using a Windows or Mac Operating System, and the version number. To find the exact version, visit this link. Whatsmyos.
If the full feature software and drivers has been installed.
Please see this post, Want Good Answers? Ask Good Questions, by @Bob_Headrick, so you can get the most out of these forums.
Thank you for posting, and I hope to hear from you soon!
RnRMusicMan
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos Thumbs Up" to say “Thanks” for helping!

I got an iPhone 4 a week ago. I synced my iTunes once and now I want to change what albums and playlists are on my phone. When I try to do this, iTunes threatens to remove all my apps. Of course, Apple's support is no help.

I got an iPhone 4 a week ago. I synced my iTunes once and now I want to change what albums and playlists are on my phone. When I try to do this, iTunes threatens to remove all my apps. Of course, Apple's support is no help. I know there has to be a way to add and remove whole albums and playlists like on the music tab on the device, so please don't tell me to uncheck/delete everything from my iTunes that I don't want and re-sync. That is not helpful and not the issue. How do I get around it threatening to remove all my apps?

On the MacBook, go to System Preferences > Security & Privacy > Privacy > Advanced > Disable remote control

IDSM-2 (7.0.2) want it to monitoring traffic and not affect anything

Similar Messages

Maybe you are looking for