Is there any documentation that explains the anticipated behavior with a sensor that has the same suspicious traffic pass by (promiscuous) or through (in-line) interfaces on the same sensor?
The new Cisco IPS course materials has one short note: If the same traffic enters the sensor on multiple interfaces, you may experience difficulties. The sensor may generate duplicate alerts for non-TCP traffic. For TCP traffic, you may get many 13xx alerts or TCP stream collisons resulting in no alert.
I'm working with a sensor in the lab with one in-line pair and one promiscuous interface each protecting a separate network. If traffic travels from one of the protected networks to the other I sometimes get duplicate alerts, and sometimes I don't. But it isn't based on TCP vs non-TCP traffic. I'm seeing double alerts for regex based TCP signatures. Scans seem to only generate a single alert.
Thanks for any info or pointers to info.
KEP
