Twitter Facebook

Jump to content



For Support/complaints mail to [email protected]

For Data center questions: Datacenter-IE.com & DC-IE.com & CCIEDatacenter-IE.com
For Routing and Switching questions: Router-IE.com & CCIERNS-IE.com
For Security questions: Security-IE.com & CCIESecurity-IE.com
For Wireless questions: Wireless-IE.com & CCIEWireless-IE.com
For Service Provider questions: ServiceProvider-IE.com & SP-IE.com & CCIEServiceProvider-IE.com
For Collaboration-IE questions : Collaboration-IE.com & CollaborationIE.com & CCIECollaboration-IE.com
For CCDE-IE questions - CCDE-IE.com
For JUNIPER-IE questions : JUNIPER-IE.com & JUNIPERIE.com


Photo

LAB 4 - IPS Section Custom OSPF Signature


1 reply to this topic

#1 roed24

 
roed24

    Member

  • Members
  • PipPip
  • 18 posts
  • 8 thanks
 

Posted 15 September 2014 - 09:20 AM

Hi Everyone,

LAB 4, IPS Section question says:

A custom signature 61000 is required on the Cisco IPS sensor as follows:  
Trigger - Whenever it detects an OSPF Hello packets .  
Action – Produce verbose Alert when OSPF Packet is detected  
Alert-severity – High  
Signature-Definition 0

I made a custom "Atomic IP" signature that triggers when it matches "Other Protocol -> 89"

Can anyone confirm if this is the right solution? Is there a way to be more specific and trigger only for HELLO packets and not for the entire protocol?


Thanked by 1 Member:
hussain18

#2 akankshu_aditya

 
akankshu_aditya

    Member

  • Members
  • PipPip
  • 14 posts
  • 0 thanks
 

Posted 22 September 2014 - 12:41 AM

As far as I know that's right whatever you did.



Reply to this topic



  


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users