Tuning Cisco IPS Sweep Engine


I'm trying to tune some of the noiser sweep signatures on a IPS

6.0/6.1 set of sensors so that they only hit on a pre-defined set of "dark" ip addresses. I've created a signature variable to store my IP list and tuned each signature with this variable as the "dst addr filter" only to discover that this filter hits on everything but the IPs in the filter list. Using a "!" in front of the variable name gives a parse error. Is there any way to accomplish what I am trying to do short of setting the dark variable to all IP addresses besides the ones I am trying to monitor?


Reply to
Loading thread data ...

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.