05-22-2008 07:54 AM
According to the MARS user guide "After being inserted into a network, MARS studies the network usage for a full week, including the
weekend, to determine the usage baseline. Once the baseline is determined, MARS switches to detection
mode."
How does one know when MARS swicthes to detection mode?
05-22-2008 09:07 AM
Hi Niall,
I have been asked about this countless times by my customers. At the moment there is no way to tell when a MARS box has changed from baselining the network to detection mode.
All I can tell you is that I have asked Cisco to add it to their list of Product Enhancement Reequests.
Hope this helps.
Best,
Paul
05-22-2008 09:08 AM
Thank you for the info
05-23-2008 06:54 AM
You are welcome.
Thanks for posting to this forum and not one of the other Security forums. There are so many Cisco Security products I'm hoping that this new forum will allow us to focus our efforts and not have to search multiple forums for answers. It also takes the guess work out of where to post a question.
Cheers!
Paul
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: