Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

How to ignore signature from specific source port ?

Hi all ,

I have a problem here , I need to ignore a specific signature from specific network , I know how to do this , but I need to ignore it if coming from specific source port . Does anybody know to do this ?

Thanks for your help

6 REPLIES
New Member

Re: How to ignore signature from specific source port ?

Sorry , I forgot to mention I have Cisco IDS 4230 version 3.1(3)S49 .

New Member

Re: How to ignore signature from specific source port ?

x

New Member

Re: How to ignore signature from specific source port ?

Hi all,

does anybody have solution to this ? or this can't be done on cisco IDS ?

Thanks

New Member

Re: How to ignore signature from specific source port ?

Hi.

F.Y.I.

In packetd.conf, there's a section "# Excluded events" which

I think you can specify if you take that sig or not depending on

Source IP address/Network and Destination IP address/Network.

RecordOfExcludedAddress SigID SubSigID SrcIP/Network

RecordOfExcludedPattern SigID SubSigID SrcIP/Network DstIP/Network

And when you look into the Cisco online manual

http://www.cisco.com/en/US/products/sw/secursw/ps5052/prod_technical_reference09186a00800d9dd5.html#74373

There you can find "Included" also. such as below.

RecordOfIncludedAddress SigID SubSigID SrcIP

RecordOfIncludedPattern SigID SubSigID SrcIP DstIP

Appologize if you've already had this info.

Best Regards,

Kentanu

--

New Member

Re: How to ignore signature from specific source port ?

I have asked this same question. The answers I have received were that it cannot be done. I am running version 4.1. I was told by Cisco that this should be pushed through our sales team to get it implemented in future releases.

New Member

Re: How to ignore signature from specific source port ?

134
Views
0
Helpful
6
Replies
CreatePlease login to create content