Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Dealing with False Positive alerts

I have hits on a BO2K-UDP signature. I looked up the ip address on Arin and it is from a company that we would probably do business with. Using nmap, I fingerprinted the remote server and it appears to be a standard MS Web/Mail server.

How do I tell IPS to ignore the host while paying attention to the rule ?


New Member

Re: Dealing with False Positive alerts

Set up an Event Action Filter to subtract the action of producing an alert when the alert includes for instance from attacker ip on port 4500 to this victim ip on port 4500 and the reverse

I'm not sure if that's what you're asking but I hope that helps

Re: Dealing with False Positive alerts

Do the 'event action filter' bit only if you are seeing this event numerous times. Occasionally any web client (browser) could choose the source port 4500 at random. The returning traffic from the web server to the client on port 4500 is consider BO2K by the IPS.



New Member

Re: Dealing with False Positive alerts

4500 UDP is for VPN tunnels. It is often a false positive for what you referenced. Just create Flase Postive event for the two hosts and tune it to log to DB only if you are using CSMARS, and I think it has already been answered for the IPS.