Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

New signature for flood control

I am in need of help in writing my own signature to control dictionary attacks on a proprietary application on one of our main frame applications.

I was looking at writing a rule using the flood net engine. Does anyone have more information on what the different variables for this engine are? If I set the rate for 3 and the peaks and gaps to 0, will this block the 4th attempt in a second?

I also need to try to lock this signature down. I could not allow it to block every 4th connection attempt from one IP address. How can you lock this signature down to a specific port and IP address? Does it need to be written into a meta engine signature?

Thanks

Gary

1 ACCEPTED SOLUTION

Accepted Solutions
Gold

Re: New signature for flood control

details matter, but that seems like a less than optimal choice for the engine. Load up the signature policy and do a select by "sig name". Enter "failure" in the sig name box and click find. You might try modeling a signature after the one of these (6256-0 for example). Is there anything in the response that you can look for?

2 REPLIES
Gold

Re: New signature for flood control

details matter, but that seems like a less than optimal choice for the engine. Load up the signature policy and do a select by "sig name". Enter "failure" in the sig name box and click find. You might try modeling a signature after the one of these (6256-0 for example). Is there anything in the response that you can look for?

New Member

Re: New signature for flood control

Thank you. You got me going in the right direction. I created the rule with the Atomic IP engine, and it is working fine.

Gary

141
Views
0
Helpful
2
Replies
CreatePlease to create content