MARS not seeing attacks

[kelvindam]

Hi all,

I have a MARS 20 setup, recieving logs from 3 routers. When I ping between the routers I can see in the MARS reports that the ICMP packets are traversing as supposed. But when I run a Port Sweep / SYN attack, the Mars box doesnt see it, and offcourse not creates a incedent.

Any ideas pls ?

Kdam

[john.stark]

Have you tried sending Netflow from those three routers? Maybe syslog is not sending enough information for Cisco MARS to correlate those events into a portsweep/syn attack.

Do you have any IDS that could report to MARS? Those products are capable of detecting port sweeps.

When you start sending netflow to Cisco MARS it will take a few days or even weeks to baseline the traffic.

[wiluszm]

Keep in mind that the MARS appliance functions by correlating information as received from reporting devices. Assuming you're using a basic IOS IP Cisco router, a port scan is not a logged event on a Cisco router. As mentioned above you need a device capable of detecting port scans and monitoring the router. The easiest solution is to run IOS IPS on your routers. This would add intrusion detection logic to your router and will report the events back to MARS. If I take the example of scanning our 3845s at HQ... the port scan is not reported by the 3845 in MARS, but rather our HQ IPS detects the scan and reports it. Rather, the 3845 is the destination of the attack and is reported as such in MARS. Hope this helped and ask if you have anymore questions.

-Mike

http://cs-mars.blogspot.com