Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Basic Sensor Doubts

Hi all,

I am having some basic doubts regarding the functionality of the sensor.

case 1

------

Assume that sensor is in inline mode.Then

1) By default "stop" atomic attacks

2) By default "stop" attacks that span multiple packets

3) By default block IP address or network addresses without "blocking" being configured?

In the above case how is "stoping" an attack differnet from blocking it?

case 2

------

Assume that sensor is in promiscous mode

1) By default "stop" atomic attacks

2) By default "stop" attacks that span multiple packets

3) By default block IP address or network addresses without "blocking" being configured

Also in this case how is "stoping" an attack different from "blocking" an IP or network address?

Thanks in advance

MD

1 REPLY
New Member

Re: Basic Sensor Doubts

Doesn't blocking actually drop all traffic from that IP for a specified period while dropping or stopping means it drops the packets as they are triggered?

110
Views
0
Helpful
1
Replies