IPS events appear even after traffic is blocked.

Unanswered Question
Feb 26th, 2009

I've been logging what is very obviously an attack directed at some of my dns servers. My router/IDS has logged hundreds of thousands of these requests in the last 7 days.

The router is reporting the following events in my syslog which is what initially alerted me to the condition:

IPS-4-SIGNATURE: Sig:4620 Subsig:0 Sev:2 DNS Limited Broadcast Query

My question is, I blackholed the offending source IP address but the events haven't stopped.

Does this mean that the attack is still getting through?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
smalkeric Wed, 03/04/2009 - 17:45

It looks like you are seeing IPS events on your router and would like more info. We host a site specifically to lookup signatures to get more info. In this case the signature is 4620, and the subsig is 0. Simply open a browser and go to http://www.cisco.com/security and click on the "Advanced Search" link. You can then select "Signatures" and put the

signature number into the keyword field.

Actions

This Discussion