Signature not shown on events monitor or reports

kim.pham · ‎11-11-2003

When tracking MSBlaster using snoop, it shows many internal source IP addresses going out to the internet. Do you know why Sig id 5365 is not shown on the events monitor or any type of reports? The sig id is enable.

Thanks,

Kim.

lwierenga · ‎11-11-2003

Assuminig you are using 4.x issue commands:

sensor(config)#service netw

sensor(config-NetworkAccess)#show settings

Look at the signature enabled on the sensor

kim.pham · ‎11-12-2003

Thank you for your reply.

We are using 3.x and the sig is enabled. Question is why VMS does not show what we see on the sensor?

lwierenga · ‎11-12-2003

Has it worked and then it isn't working? What sp/sig level are you at presently?

kim.pham · ‎11-13-2003

We are using S58. Is there a signature that we can custom or one that exists to show machines that are excessively sending SYN packets to every single subnet on the internet?