This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS can not generate an alert!

I generated a ICMP packet, which the source and destination IP address are the same. The IP address is the astaro's address. But I can not see the log about the bad traffic packet. Please tell me why. Thank you!

This thread was automatically locked due to age.

Parents

0 JimmyM over 21 years ago

Definitely upgrade to the latest version first. Then, make sure the IPS rule for that signature is activated. It IPS rules screen will show the hit count for that rule but if it isn't activated, it won't generate an alert. Also check your alert threshold. For testing purposes, set it to notify on all alerts.
Now retest.
Cancel
Vote Up 0 Vote Down

Cancel
0 Gert Hansen over 21 years ago in reply to JimmyM

Hi there,

you will not get an IPS event,
because the SPOOFING Protection of ASL will drop the packet,
and it therefore will never reach the IPS.

you should see a entry in the packetfilter.log

Regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Gert Hansen over 21 years ago in reply to JimmyM

Hi there,

you will not get an IPS event,
because the SPOOFING Protection of ASL will drop the packet,
and it therefore will never reach the IPS.

you should see a entry in the packetfilter.log

Regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data