01-16-2008 01:01 PM - edited 03-10-2019 03:56 AM
Why don't signatures 1301 and 1304 produce alert even if "Produce Alert" event-action is specified for those signatures (promisc. mode)?
Is it possible to send RST or shun a connection in promisc. mode when those signatures fire?
01-22-2008 12:35 PM
There are certain parameters to be configured and checked if don't see an alert. Refer URL
http://cisco.com/en/US/docs/security/ips/5.0/configuration/guide/idm/dmts.html#wp1033
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide
Log in to Community