TCP Reset and Blocking

I am configuring IPS 4270-20.
I want to know that how TCP Reset would reset a session without having an IP Address.
Secondly which interface would be used by ARC to controls blocking and rate limiting actions on managed devices.
Regards,
Shahzad.

Your switchports will be set to 'access' if you are using 'physical interface inline pair' mode and it will be a trunk when you are using 'inline vlan pair mode'.
And the following is one of Marc's post regarding alternate tcp reset, its rarely required:
"Under most installations the alternate tcp reset interface is not needed.
By default the TCP resets will go back out the same interface where the attack was detected.
So if your promiscuous interface is connected to a 100Mbps hub for monitoring then the tcp resets will be sent back out that same promiscuous interface into the hub.
Or if your promiscuous interface is connected to the span port of a switch, then the tcp resets will be sent back out the same promiscuous interface into that span port.
The issue becomes no whether the sensor can send the tcp resets, but if the switch will accept them. Many switches Will accept tcp resets coming in from the span port. Some switches just require an extra parameter on the span configuration to tell the switch to allow incoming packets from the span port.
BUT there are some switches that do NOT allow incoming packets from their span ports.
These ituations are the reason for the alternate tcp reset interface configuration.
It requires having 2 sensing interfaces (one for promiscuous monitoring, and the the other used as just the alternate tcp reset interface). The command and control port can NOT be used as the alternate tcp reset interface.
You connect the promiscuous interface up to the span port of the switch. You configure the second interface as the alternate tcp reset interface of the first promiscuous interface. Then plug the second interface into the saem switch (but do Not make the 2nd one a span port).
Now when the sensor detects an attack on the 1st interface it will NOT send the tcp resets out the 1st interface, but instead will send out the tcp resets on the 2nd interface.
Since the switch won't accept the tcp resets from the span port you need the second interface to get the tcp resets into the switch.
This can also be done with taps where the taps (because taps have no means of accepting incoming packets).
The alternate tcp reset interface configuration is ignored when configured for inline monitoring. It is only used with promiscuous monitoring. "
Regards
Farrukh

Similar Messages

  • IDSM-2 disable tcp reset and RiskRating

    Hi all, i have a IDSM-2 and it's not ywet in production because I need to set the IDSM-2 to just monitor the connection and do not take any action...
    The module is in the default signatures configuration and some of the active signatures have the TCP reset option marked.... and some signatures have RiskRating set to 100. It's a problem because the Event action rule will drop the signatures with a risk rating of 100.
    Is there any way to have the IDS just in monitoring state?
    How can I do it?
    The IDSM-2 is in promiscuous mode... and I have about 50 vlans going trough the module with a SPAN configuration
    Thanks in advance.
    Fabio

    Yes, you may use IDSM2 in promiscuous mode to monitor SPAN-session. It is the best way in your case because the module will not affect the traffic.
    But also you can disable the event-action for high-risk rating signatures. I think it will be useful because you have 50 vlans and this amount of traffic may cause high CPU load.

  • TCP RESET - CISCO IPS 4240 in IDS Mode - Block Teamviewer

    I would like to block teamviewer in my network. we are using CISCO IPS 4240 in IDS Mode. I found that there are signatures for teamviewer in latest Signatures.
    We have only configured promiscuous interface, I read that we can issue TCP resets thru promiscuous interface as well (recommended is dedicated tcp reset interface).
    However in my case, I found that Signatures for teamviewer is not getting fired even after getting successful teamviewer connections.
    I am a beginner is IPS, Any inputs will be valuable for me.

    We're talking about sigs 15002-0, -1, -2 here. They are by default shipped disabled and retired, so you'll want to enable and activate them.
    For these, the signature settings are not hidden and what they look for is pretty clearly documented in the sig description.
    -0 looks for some specific DNS requests on TeamViewer's startup. TCP resets will have no effect on this.
    -1 looks for specific traffic to tcp port 5938 which would indicate Teamviewer's direct-connection method
    -2 looks for traffic indicating use over http when teamviewer is configured to use a proxy
    TCP resets are a best effort response, they aren't going to be a 100% effective stop

  • Does cisco router support "tcp reset" mesg when the traffic blocked by access lit ?

    hi ,
    im trying to know if i  blocked a destination with an access list on cisco.
    can i make "tcp-rest " to that connection instead on dropping it ??
    i belive it supported on ASA appliance , but not sure if supported on cisco routers.
    im trying to migrate from linux router to cisco router and apply the same config , one of the challenging task is , i have 
    "reject-with=tcp-reset"
    im wondering if i can do it on cisco router
    waiting ur responce
    regards

    One of the things that keeps me engaged with these forums is that they challenge me and give me opportunities to learn new things. My initial reaction to your question about IPS on IOS router was to say that this is not supported. But I did some research and find that apparently IPS functionality is now supported on some (but not all) of Cisco IOS routers. See this link for additional detail:
    http://www.cisco.com/c/en/us/products/collateral/security/ios-intrusion-prevention-system-ips/product_data_sheet0900aecd803137cf.html
    HTH
    Rick

  • TCP Reset Feature

    Hi!
    I would like to realize the reset of a single TCP connection (Ip adress + port number) using a
    CISCO IDS 4235,Version 4.1(5)S194, with a
    PIX 520, IOS Version 6.3(3) and a
    4500 router, IOS Version 12.0(8b).
    Is it really possible by this hardware?
    I think I need at least ROUTER IOS version 12.2(15), but I cannot do this upgrade on my device. Is it true?
    Is the PIX able of resetting the single connection? Maybe IOS Ver 7.00 needed?
    It's possible to upgrade PIX 520 ?
    Thank you in advance!

    TCP reset feature on the IDS by default will send out a TCP reset through the sniffing interface.
    However, it sounds like you are talking about shun connection rather than tcp reset. A shun will effectively block the connection by applying a filter (rather than a packet to terminate the connection), it does this by applying this filter on your router or PIX.
    On the PIX this is achieved through a filter function called a shun command. This is actually available on the version of PIX you are running (6.3.x)
    On the Router an ACL is applied on an interface.
    I hope that helps.
    -jonathan

  • TCP Reset Confusion

    I have confiugred TCP string signature to reset the connection when user try to open certain URL.
    I have configured no device for blocking action.
    but still i am able to block. Why it is so, How IPS able to block URL.
    Please let me know is TCP reset require any device to be in blocking list or IPS itself send the reset packet to user.

    The option is not configurable for Firewalls(or a Cat 6K switch as well).
    This is because the option is only applicable to the Routers.
    With Routers you have to choose whether to do Blocking or Rate Limiting or both.
    With the Firewalls (and Cat 6K Switches) the only thing you can do is Block. Since the only thing you can do is Block, it is not necessary to select it. The parameter just simply doesn't exist for the Firewall because it is unnecessary.
    This is a bug in IDM. IDM re-used the Router screen for Firewalls and greyed out the field, but it should have creatd a new Screen for Firewalls and left it completely out.
    As for why shunning to the Firewall is not working, here are a few things to try.
    1) Through IDM add an address to Shun/Block. Then check the Firewall with a "show shun" command to see if the address was shunned. If not proceed to step 2.
    2) Execute "show events past 00:05:00" to look at the events for the past 5 minutes. FInd the event where you added the shun/block, and look to see if there were any errors after it.
    3) Execute "show stat network-access" and look to see what is reported for your Pix. It may report an error as to why it can't connect.
    If there is still no luck figuring out why it can't connect then try:
    4) In the shun/block configuration screens there should be a Block Enable option that you can set to False and Apply the configuration. This should force the sensor to disconnect from all Shun/Block devices.
    5) Execute "show events" in a CLI connection and keep it running.
    6) Now set Block Enable back to True and Apply the configuration.
    7) Look back at the "show events" output and look for any messages about the sensor connecting to the Firewall to see if an Error is generated.
    I also remember a bug in an older version, that I believe is fixed in newer service packs.
    Execute "show shun" on the Firewall and see if there are any existing shuns.
    Remove any existing shuns on the Firewall with the "no shun" command.
    And then try numbers 4-7 again.
    There were special cases where some existing shun entries caused a problem on the sensor because newer Pix versions modified how they output the shun list.
    If clearing out the shun list fixed your problem, then you may have been hitting this bug, and you may need to upgrade your sensor in order to keep from hitting it in the future.

  • Tcp Reset question - IPS Sensor 4255

    I have this sensor doing tcp resets, the question I have is if I add a network to the "never block addresses" will the sensor still send tcp resets even though the network is in the never block? if so how do I tell the sensor to not block certain ip addresses..
    Thanks in advance
    Phil

    You can configure sensors to send TCP reset packets to try to reset a network connection between an attacker host and its intended target host. In some installations when the interface is operating in promiscuous mode, the sensor may not be able to send the TCP reset packets over the same sensing interface on which the attack was detected. In such cases, you can associate the sensing interface with an alternate TCP reset interface and any TCP resets that would otherwise be sent on the sensing interface when it is operating in promiscuous mode, are instead sent out on the associated alternate TCP reset interface.
    http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_installation_guide_chapter09186a008055fc77.html

  • ASA 5510 Firewall internet Restriction based on IP address and block rest users excluding Mails

    Hi,
    As i have assignment to create access list based on IP address like we have to allow internet access this IP range 192.168.172.201 to 212.
    And rest users we have to block excluding Mails.
    Please help.
    Thanks,
    Regards,
    Hemant Yadav 

    login as: Rakh
    [email protected]'s
    password:
    Type help or '?' for a list of available commands.
    FAST-HQ-ASA> en
    Password:
    Invalid password
    Password: ***********
    FAST-HQ-ASA# show rum
                        ^
    ERROR: % Invalid input detected at '^' marker.
    FAST-HQ-ASA# show run
    : Saved
    ASA Version 8.3(1)
    hostname FAST-HQ-ASA
    enable password 7tt1ICjiO2a2/Hn2 encrypted
    passwd U8oee3lIrDCUmSK2 encrypted
    names
    interface Ethernet0/0
    description ASA Outside segment
    speed 100
    duplex full
    nameif OUTSIDE
    security-level 0
    ip address 62.173.33.67 255.255.255.240
    interface Ethernet0/1
    description VLAN AGGREGATION point
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.2
    description INSIDE segment (User)
    vlan 2
    nameif INSIDE
    security-level 100
    ip address 192.168.172.1 255.255.255.0
    interface Ethernet0/1.3
    description LAN
    vlan 3
    nameif LAN
    security-level 100
    ip address 192.168.173.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network INSIDE
    subnet 192.168.172.0 255.255.255.0
    object network LAN
    subnet 192.168.173.0 255.255.255.0
    object network MAIL-SERVER
    host 192.168.172.32
    object network DENY-IP-INTERNET
    range 192.168.172.121 192.168.172.200
    object-group service serBLOCK-INTERNET tcp
    port-object eq www
    object-group network BLOCK-IP-INTERNET
    network-object object DENY-IP-INTERNET
    access-list 102 extended permit icmp any any time-exceeded
    access-list 102 extended permit icmp any any echo-reply
    access-list OUTSIDE-IN extended permit tcp any host 192.168.172.32 eq smtp
    access-list OUTSIDE-IN extended permit tcp any host 192.168.172.32 eq https
    access-list BLOCK-WWW extended deny tcp object-group BLOCK-IP-INTERNET any object-group serBLOCK-INTERNET
    access-list BLOCK-WWW extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu OUTSIDE 1500
    mtu INSIDE 1500
    mtu LAN 1500
    mtu management 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    object network INSIDE
    nat (INSIDE,OUTSIDE) dynamic interface
    object network LAN
    nat (LAN,OUTSIDE) dynamic interface
    object network MAIL-SERVER
    nat (INSIDE,OUTSIDE) static 62.173.33.70
    access-group OUTSIDE-IN in interface OUTSIDE
    access-group BLOCK-WWW out interface OUTSIDE
    route OUTSIDE 0.0.0.0 0.0.0.0 62.173.33.65 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    vpn-addr-assign local reuse-delay 5
    telnet timeout 5
    ssh 192.168.172.37 255.255.255.255 INSIDE
    ssh 192.168.173.10 255.255.255.255 LAN
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username Rakh password EV9pEo1UkhHJSbIW encrypted
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1ee78d19f958efc6fd95f5e9d4e97b8d
    : end
    FAST-HQ-ASA#

  • Async tcp client and server. How can I determine that the client or the server is no longer available?

    Hello. I would like to write async tcp client and server. I wrote this code but a have a problem, when I call the disconnect method on client or stop method on server. I can't identify that the client or the server is no longer connected.
    I thought I will get an exception if the client or the server is not available but this is not happening.
    private async void Process()
    try
    while (true)
    var data = await this.Receive();
    this.NewMessage.SafeInvoke(Encoding.ASCII.GetString(data));
    catch (Exception exception)
    How can I determine that the client or the server is no longer available?
    Server
    public class Server
    private readonly Dictionary<IPEndPoint, TcpClient> clients = new Dictionary<IPEndPoint, TcpClient>();
    private readonly List<CancellationTokenSource> cancellationTokens = new List<CancellationTokenSource>();
    private TcpListener tcpListener;
    private bool isStarted;
    public event Action<string> NewMessage;
    public async Task Start(int port)
    this.tcpListener = TcpListener.Create(port);
    this.tcpListener.Start();
    this.isStarted = true;
    while (this.isStarted)
    var tcpClient = await this.tcpListener.AcceptTcpClientAsync();
    var cts = new CancellationTokenSource();
    this.cancellationTokens.Add(cts);
    await Task.Factory.StartNew(() => this.Process(cts.Token, tcpClient), cts.Token, TaskCreationOptions.LongRunning, TaskScheduler.Default);
    public void Stop()
    this.isStarted = false;
    foreach (var cancellationTokenSource in this.cancellationTokens)
    cancellationTokenSource.Cancel();
    foreach (var tcpClient in this.clients.Values)
    tcpClient.GetStream().Close();
    tcpClient.Close();
    this.clients.Clear();
    public async Task SendMessage(string message, IPEndPoint endPoint)
    try
    var tcpClient = this.clients[endPoint];
    await this.Send(tcpClient.GetStream(), Encoding.ASCII.GetBytes(message));
    catch (Exception exception)
    private async Task Process(CancellationToken cancellationToken, TcpClient tcpClient)
    try
    var stream = tcpClient.GetStream();
    this.clients.Add((IPEndPoint)tcpClient.Client.RemoteEndPoint, tcpClient);
    while (!cancellationToken.IsCancellationRequested)
    var data = await this.Receive(stream);
    this.NewMessage.SafeInvoke(Encoding.ASCII.GetString(data));
    catch (Exception exception)
    private async Task Send(NetworkStream stream, byte[] buf)
    await stream.WriteAsync(BitConverter.GetBytes(buf.Length), 0, 4);
    await stream.WriteAsync(buf, 0, buf.Length);
    private async Task<byte[]> Receive(NetworkStream stream)
    var lengthBytes = new byte[4];
    await stream.ReadAsync(lengthBytes, 0, 4);
    var length = BitConverter.ToInt32(lengthBytes, 0);
    var buf = new byte[length];
    await stream.ReadAsync(buf, 0, buf.Length);
    return buf;
    Client
    public class Client
    private TcpClient tcpClient;
    private NetworkStream stream;
    public event Action<string> NewMessage;
    public async void Connect(string host, int port)
    try
    this.tcpClient = new TcpClient();
    await this.tcpClient.ConnectAsync(host, port);
    this.stream = this.tcpClient.GetStream();
    this.Process();
    catch (Exception exception)
    public void Disconnect()
    try
    this.stream.Close();
    this.tcpClient.Close();
    catch (Exception exception)
    public async void SendMessage(string message)
    try
    await this.Send(Encoding.ASCII.GetBytes(message));
    catch (Exception exception)
    private async void Process()
    try
    while (true)
    var data = await this.Receive();
    this.NewMessage.SafeInvoke(Encoding.ASCII.GetString(data));
    catch (Exception exception)
    private async Task Send(byte[] buf)
    await this.stream.WriteAsync(BitConverter.GetBytes(buf.Length), 0, 4);
    await this.stream.WriteAsync(buf, 0, buf.Length);
    private async Task<byte[]> Receive()
    var lengthBytes = new byte[4];
    await this.stream.ReadAsync(lengthBytes, 0, 4);
    var length = BitConverter.ToInt32(lengthBytes, 0);
    var buf = new byte[length];
    await this.stream.ReadAsync(buf, 0, buf.Length);
    return buf;

    Hi,
    Have you debug these two applications? Does it go into the catch exception block when you close the client or the server?
    According to my test, it will throw an exception when the client or the server is closed, just log the exception message in the catch block and then you'll get it:
    private async void Process()
    try
    while (true)
    var data = await this.Receive();
    this.NewMessage.Invoke(Encoding.ASCII.GetString(data));
    catch (Exception exception)
    Console.WriteLine(exception.Message);
    Unable to read data from the transport connection: An existing   connection was forcibly closed by the remote host.
    By the way, I don't know what the SafeInvoke method is, it may be an extension method, right? I used Invoke instead to test it.
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • I have had to semi-reset and reinstall my hp6500a plus. How do I keep the same eprint email address?

    I have had a network blowup and a new computer and was told to do a semi-reset and full install on my Inkjet hp6500a plus. How do I keep the same eprint email address which I have given out to a number of people? When I did the install I seem to have been re-assigned a new @hpprint address and can't find how to change it back.

    Hi,
    I affraid you will not be able to use the same address.
    Due to security reasons any removed ePrint address (due to Web Services removal, product reset or product replacement) is blocked for any user for 6 months period.
    You may select a difference customized address by following the steps below:
    http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02940150&cc=us&dlc=en&lc=en
    Regards,
    Shlomi
    Say thanks by clicking the Kudos thumb up in the post.
    If my post resolve your problem please mark it as an Accepted Solution

  • HP LaserJet P1505n stops printing and blocks network interface

    I have been using my P1505n for over two years without any problem. But it suddenly stopped printing. The scenario is as follows:
    1. The P1505n is connected to a wired home network with reserved IP address in the DHCP server.
    2. The P1505n is used from Ubuntu 10.4, 11.4 , Windows XP and Windows 7 without any previous problems.
    3. The last partial successful print job stopped in the middle of a page leaving the rest blank: no paper jam.
    4. I have reset the printer several times: turn off + press Cancel & Go + turn on while holding the two buttons down.
    5. The first reset was successful: the toner level going from 40 to 100%. The next ones may have been successfull too.
    6. After each reset and also after each power-on, I can ping and access the embedded web server.
    7. Whenever I send a print job, the print queue on the computer (all OS behave identically) says "printing" and stops. I can cancel/remove the jobs from Ubuntu.
    8. After the printer receives the print job, it silently blocks the network interface (no ping nor web) and doesn't print anything. No movementsm no LED blinking either: just nothing happens.
    What is the reason for this problem? And how do I solve it?

    Hi firedude007,
    Welcome to the HP Forums!
    I see that your HP Laserjet P1102w stops printing files from your Mac but not on Windows, and I am happy to help!
    For further assistance, I will need to know the following information:
    The version number of the Mac Operating System. To find the exact version, visit this link. Whatsmyos.
    If the printer is connected, Wireless, or USB.
    If the printer is able to make copies by itself.
    In the meantime, I would try the following:
    Reset the printing system. Mac OS X: How to reset the printing system.
    Verify and repair disk permissions. Disk Utility 12.x: Repair disk permissions.
    Hope to hear from you, and thank you for posting!
    RnRMusicMan
    I work on behalf of HP
    Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
    Click the “Kudos Thumbs Up" to say “Thanks” for helping!

  • When I open up a new mail in Yahoo! Mail, email addresses from previous mails stay on screen and block the "copy to" bar. How do I get rid of this?

    When you are typing the addresses into a Yahoo! Mail, the browser helps you by suggesting people from your address book in a drop down box.
    But when I've finsihed that mail and open up a new one, old addresses remain on screen and block the "copy to" box. You can't click on them or zap them, they are just fixed on screen.
    Have had this probelm for a long time, through many Firefox updates and also having moved to a new Mac.

    Reset it by holding the power and home buttons at the same time until you see the Apple logo, then release.

  • HT4759 My icloud  Backup text keeps showing and blocking my screen. I can't use my Ipad now

    My icloud  Backup text keeps showing and blocking my screen. I can't use my Ipad. I touch on either "Ignore" or "Setting" but it doesn't go away.

    Reset it by holding the power and home buttons at the same time until you see the Apple logo, then release. (If you see an off slider first, ignore it.)

  • Nokia N8, I updated maps and blocked, does not sta...

    I updated maps and blocked, does not start
    Solved!
    Go to Solution.

    as I can see the problem is caused by the update 2 / 2 anna
    must do a hard reset update 1 / 2 and 2 / 2 anna, then go to nokia store and download &quot;ovi maps&quot; and install
    reappears update 2 / 2 anna, do not update, otherwise the problem will return.

  • W32.conficker.worm - detection and blocking with a IPS 4235

    We have an IPS 4235 system with IPS-K9-5.1-8-E3 Engine and sig file IPS-sig-s368-reg-E3 in fron of our Firewall. We also (unfortunately) have the w32.conficker worm which is causing a DDOS and flooding the network with TCP 445 traffic. We are trying to set up the IPS to block this traffic before it hits our Firewall so that we can restore external WAN links.
    The IPS system sucessfully detects this 445 traffic as signature ID 1302 and fills the event log, but even though we have enabled "deny connection inline" in the "signature configuration" - it still does not seem to block the 445 traffic. Has anyone seen this before, and could they advise us on how to effectively block this traffic?

    Hi,
    Regardless of what the Signature fire's on you should still be able to set an action.
    I could set it to fire on receiving any tcp syn and request a deny attack inline. If it is not working then I would question the configuration not the signature attribute.
    A google search found this information regarding the worm. It seems to download a file via a random HTTP port. Perhaps you could look at using the AIC HTTP engine, and matching on the filename with a regex.
    “This malware mostly spreads within corporations but also was reported by several hundred home users. It opens a random port between port 1024 and 10000 and acts like a web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm.”
    Have you checked that there are no event action overrides configured that would overwrite your condition ?
    Also have you ensured that the IPS is configured to never block certain address ranges ?
    If you are seeing the signature fire then we can assume that the traffic flow has been setup correctly.
    We cannot just block based on port 445 as we will be denying genuine RPC traffic. However we could customise the signature to fire based around a combination of the HTTP post or get. Or peer to peer RPC traffic.
    HTH,
    Jon Humphries
    Nextiraone UK

Maybe you are looking for