Tuning Half-Open SYN (3050) via nrConfigure on the Unix Director

[alexbwood]

I am trying to tune event 3050 so that it will fire only once a minute maximum and then only if there have been 10 instances of this event from a particular source. Looking at the parameters in the tuning section, there are a few that seem to make sense, but others that seem to be contrasictory. I am assuming that I want to have the AlarmThrottle set to summarize and the MinHits set to 10. The rest of the parameters I am not sure about. Any ideas?

[vanandan]

Hi,

The url given below can give the information you need about the engine parameters.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/13346_01.htm

-Vinoth.

[alexbwood]

That gives some information but it does not talk about all the parameters, nor does it give much deatil above what it gives already in nrConfigure. Does anyone have more detailed information or can someone tell me specifically how to tune the sig so that it will only fire once for every 10 hits/minute? Also, if there a way to test that it is working right?