limiting by sessions

rnaydenov · ‎01-03-2008

Hi guys,

Is there a way that I can make a custom signature to detect if any given host has reached a predefined limit of sessions to specific host. I know this can be done with ASA, but can it be done with IPS functionality?

didyap · ‎01-09-2008

Following links may help you

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgeng.html

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clisgdef.html

mhellman · ‎01-09-2008

Yes, you can do this. I assume you're talking about TCP sessions, right? Take a look at 3041-1, TCP SYN/FIN Packet. Copy it. Change the TCP flags to SYN. Change the TCP mask to SYN|FIN|ACK|RST|PSH|URG. Change the destination port range to the desired values. Change the event count and interval to the number of sessions that must be reached over the time interval before the alarm will fire.