Force10 Networks PSeries 100-00055-01 Manual de usuario Pagina 5
- Pagina / 132
- Tabla de contenidos
- MARCADORES
Valorado. / 5. Basado en revisión del cliente
P-Series Installation and Operation Guide, version 2.3.1.2 5
Chapter 8
Compiling Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Creating Rules Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Rules Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Compiling Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Starting and Stopping the pnic-Compiler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Configuration and Generated Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Firmware Filenames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Compiler Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Chapter 9
Writing Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
P-Series Rule Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
P-Series Supported Snort Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Writing Stateful Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Stateful Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Stateful Rule Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
The meta.rules File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Support for Snort's flow Keyword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Handling Segmentation Evasion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Support for Snort's within Keyword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Anomalous TCP Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Chapter 10
Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Deploying the P-Series as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Enabling the Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Allowing Traffic through the Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Writing Rules for a Firewall Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Appendix A
Command Line Reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Appendix B
Snort Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Appendix C
Meta and Evasion Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Appendix D
Basic Unix Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
- P-Series Installation and 1
- Operation Guide 1
- Contents 3
- Appendix E 6
- Appendix F 6
- Preface About this Guide 7
- Information Symbols 8
- Related Documents 8
- Additional Resources 8
- Chapter 1 Installation 9
- System Specifications 10
- Physical Connections 10
- Configuration 12
- Security Check 12
- Upgrading Software 12
- Chapter 2 Getting Started 15
- 16 Getting Started 16
- Chapter 3 Introduction 17
- Types of Rules 18
- Sample Rules and Firmware 18
- Rule Management 19
- Deploying the P-Series 19
- Inline Deployment 20
- Fail-safe Deployment 20
- Highly-available Deployment 21
- Passive Deployment 21
- Capturing Matched Traffic 22
- Capturing to a Host CPU 23
- Mirroring to Another Device 24
- GUI Commands 26
- PNIC0 Not Active 27
- To modify dynamic rules: 29
- 30 Graphical User Interface 30
- Figure 16 30
- Figure 17 30
- Capture/Forward Policies GUI 30
- Runtime Statistics 31
- 32 Graphical User Interface 32
- Figure 19 32
- Figure 20 32
- Reloading Firmware 33
- 34 Graphical User Interface 34
- (see Appendix A , on page 36
- Monitoring System Performance 38
- Managing Firmware Images 39
- 40 Web-based Management 40
- Managing Policies 41
- 42 Web-based Management 42
- Sguil Server 43
- Sguil Clie 43
- P-Series Sensors 43
- Installing the Sguil System 44
- Installing the Sguil Client 45
- Installation Files 46
- Running the Sguil System 47
- Running the Sguil Server 48
- Running the Sguil Client 49
- Figure 33 appears 50
- CLI Commands 51
- MAC Rewriting 51
- Removing VLAN Tags 53
- 54 Command Line Interface 54
- Chapter 8 Compiling Rules 55
- Enter command gmake from 58
- Selecting Yes is recommended 59
- Summary of configuration 60
- Firmware Filenames 62
- Compiler Errors 62
- Chapter 9 Writing Rules 63
- Protocol 64
- Source Addresses 64
- Direction Operator 65
- P-Series Rule Syntax 66
- Writing Stateful Rules 68
- Stateful Rule Examples 70
- Handling Segmentation Evasion 71
- Anomalous TCP Flags 73
- 74 Writing Rules 74
- Chapter 10 Firewall 75
- Enabling the Firewall 76
- 90 Appendix A 90
- Figure 55 91
- 92 Appendix A 92
- Figure 56 92
- Disable the physical link 93
- [channel] 93
- Enable the physical link 93
- Information 95
- 0/pnic_{0 98
- [number] 103
- [number] 104
- • Stop capturing and matching 104
- Stop the Sguil sensor 107
- • Load the runtime parameters 110
- [root@localhost SW]# 112
- 114 Appendix A 114
- Stop the web server 116
- Related 117
- Commands 117
- 118 Appendix A 118
- Appendix B Snort Keywords 119
- 122 Appendix B 122
- Table 30 123
- 124 Appendix C 124
- Unix Commands 125
- Appendix E Glossary 127
- Appendix F Technical Support 129
- Step Task 131
- 132 Technical Support 132
© 2020, manymanuals.es. Todos los derechos reservados | 0.052 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Comentarios a estos manuales