Thread Info
  • State Not Answered
  • Replies 10 replies
  • Subscribers 0 subscribers
  • Views 1499 views
  • Users 0 members are here
Options
Suggested

[7.851][BUG][DUPLICATE] Top blocked attacks doesnt show and ips goes to ids mode

utm_kid
Hello Friends!

please check log 

it doesnt show any ips alert or doesnt count on dashboard or on network security tab
after ips detect it seems it went to ids mode why ?(please correct me if i am making mistake)

thanks
Parents
  • 0
    It goes to IDS mode after a restart ("Enabling inline operation").
    That is ok, since the IPS is implemented as IDS + Packet Filter.
    So the blocking (prevention) is done via iptables.

    Regards,
    Daniel
  • 0 in reply to anonymous_02
    Ok !

    understood it there was no count on dashboard not even network security did not show any thing found, even today 

    2010:01:07-18:38:08 acenn snort[6268]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="DOS DNS root query traffic amplification attempt" group="520" srcip="192.168.2.225" dstip="192.168.2.100" proto="17" srcport="1034" dstport="53" sid="15259" class="Misc activity" priority="3" generator="1" msgid="0" 

    it did not show any thing 

    thanks
Reply
  • 0 in reply to anonymous_02
    Ok !

    understood it there was no count on dashboard not even network security did not show any thing found, even today 

    2010:01:07-18:38:08 acenn snort[6268]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="DOS DNS root query traffic amplification attempt" group="520" srcip="192.168.2.225" dstip="192.168.2.100" proto="17" srcport="1034" dstport="53" sid="15259" class="Misc activity" priority="3" generator="1" msgid="0" 

    it did not show any thing 

    thanks
Children
No Data
Cookie Information Banner