tcp resets in passive mode

Unanswered Question
Mar 14th, 2007

I know the resets are done by the sensor, not the PIX or router.

Is it possible if my IDS 4235 is working in passvie mode not inline to reset tcp sessions..? If yes than please explain how it does..

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mhellman Wed, 03/14/2007 - 05:54

It is possible. Normally the sensor will send resets out the same sensing interface the traffic was detected on. If it's a hub you're using, it should just work. If it's a switch, it depends on the capabilities of the switch. Refer to the documentation for your switch as to whether it can be configured to allow ingress traffic. Here's an example for the Cisco 2950.

abolfathi_0248 Wed, 03/14/2007 - 10:32

i think it is not possible to sending tcp RST via sensor that connected to a SPAN port in Catalyst 29xx , 3550 , 3560 , 3750 becuase regarding the SPAN put the port just in ingress mode (no traffic can leave the interface).in higher-level catalyst switched like 65xx , you can use packet capturing done by CLASS-MAP / POLICY-MAP so it can let you have both RX/TX traffic.

mhellman Wed, 03/14/2007 - 13:54

The only switch I've tested the TCP RST functionality on is a 2950. It worked fine.


This Discussion