cisco ips in asa - attck to port 0 - no action

secureIT · ‎07-20-2011

Hi Netpro Team,

we have cisco asa 5510 where ip module is installed. i have given the event action rule as "deny", when i do this, the attacks destined to victim port 80 is getting denied and logged, but attack to victim port 0 does not show any action in the logs....i checked this in ips manager as well as in idm event logs.

for eg:- signature 5930/13 is fired and it denied the attacker on victim port 80 and showing the action as denied, then im getting the next same signature fired for victim port 0, but action is now showing...

somebody pls reply...........................!!!!!!!!!

secureIT · ‎07-21-2011

Hi Team,

I am unable to see the action taken and showing the victim port as zero for all the tuned signatures in ips... I really do not know if the attack is being blocked or still allowed... Need your intervention as soon as possible please..

im using sig IPS-sig-S576-req-E4. can somebody really revert please...

Dustin Ralich · ‎07-22-2011

signature 5930/13 is fired and it denied the attacker on victim port 80 and showing the action as denied, then im getting the next same signature fired for victim port 0, but action is now showing...

Sounds like you are reviewing Summary Alerts. SIG 5930.13 is set to Summarize by-default. If you could paste a copy of one of these Alerts here, the community can take a look. Feel free to redact any sensitive information (or change IP addresses) if you feel the need to do so, but, make sure that if you do, you do it consistently so we can still get a clear understanding of the Alert.

somebody pls reply...........................!!!!!!!!!

FYI, by replying back to your own Discussion (multiple times in this case), the system no longer considers the Discussion to be "Unanswered", so that may discourage the community from taking a look (thinking that someone else already had).

secureIT · ‎12-06-2011

Thanks Dustin,

Below is the events im getting from IPS... For me its difficult judge if its a summurization of events or DOS attack., Could you pls look into this..

Severity	Date	Time	Device	Sig. Name	Sig. ID	Attacker IP	Victim IP	Actions Taken	Vicitm Port	Threat Rating	Risk Rating
Tmedium	12/4/2011	22:24:43	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:24:51	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:42:00	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:00	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:01	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:02	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:02	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:03	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:04	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:42:04	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:42:04	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:42:04	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:05	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:42:05	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:42:06	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:42:20	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:42:25	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:26	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:26	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:27	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:27	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:42	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:42:46	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:47	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:47	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:48	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:42:49	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:04	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:43:06	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:06	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:07	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:08	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:08	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:23	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:43:30	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:31	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:31	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:32	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:33	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:33	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:34	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:43:34	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:43:35	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:43:35	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:43:35	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:43:36	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:43:36	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:43:50	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:43:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:57	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:57	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:58	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:43:58	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:13	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:44:18	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:18	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:19	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:19	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:20	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:35	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:44:37	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:38	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:39	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:39	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:40	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:55	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:44:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:44:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:45:00	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:45:01	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:45:01	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:45:02	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:45:07	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:45:08	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:45:23	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:46:21	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:22	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:22	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:23	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:23	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:24	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:25	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:25	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:26	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:38	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:39	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:39	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:40	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:41	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:46:41	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:52	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:52	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:53	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:53	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:54	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:55	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:56	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:46:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:46:57	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:06	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:07	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:08	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:08	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:09	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:09	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:10	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:11	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:12	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:47:12	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:27	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:47:35	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:36	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:37	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:37	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:38	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:53	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:47:55	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:47:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:47:56	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:47:57	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:47:57	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:47:57	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:48:08	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:48:12	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:48:29	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:29	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:30	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:31	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:31	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:32	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:33	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:33	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:34	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:35	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:48:35	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:48:35	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:48:36	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:48:36	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:48:36	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:48:38	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:48:38	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:48:51	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:49:08	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:08	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:09	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:10	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:10	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:11	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:12	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:12	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:13	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:14	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:14	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:15	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:16	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:31	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:49:33	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:34	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:34	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:49:35	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:49:35	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:49:35	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:49:36	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:49:36	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:49:36	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:49:51	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:49:55	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:56	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:57	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:58	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:58	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:59	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:49:59	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:00	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:50:00	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:50:01	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:50:01	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:50:01	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:50:01	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:50:02	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:50:02	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:50:02	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:17	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:50:22	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:23	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:23	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:24	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:25	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:25	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:26	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:26	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:27	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:27	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:28	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:28	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:50:29	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
medium	12/4/2011	22:50:37	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:50:38	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:50:38	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
medium	12/4/2011	22:50:39	IPS-1	Unix Password File Access Attempt	3201/1	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	50	85
high	12/4/2011	22:50:44	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:51:21	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:22	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:23	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:24	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:24	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:38	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:38	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:39	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:39	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:51:40	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:40	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35	droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95
high	12/4/2011	22:51:55	IPS-1	Generic SQL Injection	5930/5	161.69.30.158	192.168.100.35		0	95	95
high	12/4/2011	22:53:24	IPS-1	Generic SQL Injection	5930/13	161.69.30.158	192.168.100.35	tcpResetSent, droppedPacket, deniedFlow, tcpOneWayResetSent	80	60	95

balkhati · ‎07-27-2011

Dears,

you will not find any action once the Event summary feild has a value other than "0" as the IPS take an action over individual feilds not summary one.

add rate if answers your question

secureIT · ‎12-12-2011

HI EVERY ONE....

I HAVE RESOLVED THE PORT 0 ATTACK CONFUSION AS GIVEN BELOW... WE WILL HAVE TO EDIT THE SIGNATURES AND FINE TUNE IT..

########################################

Edit Signature > alert frequency:

Summary mode à Change from Summarize to Fire once

summary key à attacker

#######################################

PLS RATE IF THIS THREAD WAS HELPFUL...

athukral · ‎12-14-2011

Very nice converstaion. High 5! Please mark this as closed. Thanks and Regards, Ankur Thukral Community Manager : Security and VPN

secureIT · ‎12-14-2011

Hi Ankur,

How would i mark this topic as closed... im not aware of it...pls check.

regards

rajesh