Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Signature not shown on events monitor or reports

When tracking MSBlaster using snoop, it shows many internal source IP addresses going out to the internet. Do you know why Sig id 5365 is not shown on the events monitor or any type of reports? The sig id is enable.

Thanks,

Kim.

  • Other Security Subjects
4 REPLIES
New Member

Re: Signature not shown on events monitor or reports

Assuminig you are using 4.x issue commands:

sensor(config)#service netw

sensor(config-NetworkAccess)#show settings

Look at the signature enabled on the sensor

New Member

Re: Signature not shown on events monitor or reports

Thank you for your reply.

We are using 3.x and the sig is enabled. Question is why VMS does not show what we see on the sensor?

New Member

Re: Signature not shown on events monitor or reports

Has it worked and then it isn't working? What sp/sig level are you at presently?

New Member

Re: Signature not shown on events monitor or reports

We are using S58. Is there a signature that we can custom or one that exists to show machines that are excessively sending SYN packets to every single subnet on the internet?

102
Views
0
Helpful
4
Replies
This widget could not be displayed.