<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hello Group,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Hopefully, this topic is ok to discuss here. I am
fairly new to IDS systems and am having trouble getting my cisco IDS to send TCP
resets. The lab network is as follows:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial
size=2> R4</FONT></DIV>
<DIV><FONT face=Arial size=2>R1----IDS----|</FONT></DIV>
<DIV><FONT face=Arial size=2>
R2------R3</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>R4 and R2 are on the same ethernet segment. R1 is
on Command and Control side of the sensor. </FONT></FONT><FONT face=Arial
size=2>The attack is coming from R3 ( telnet to R4 and issue "testattack"
string ). The alarm shows up in event viewer...but no tcp reset...I
mean...my telnet session stays active. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I know this probably has something to do with how I
am setting up SPAN on the switch....but I am not sure. The IDS Sensing
interface, R4 and R2 are on the same switch and in VLAN 20. R3 is in VLAN
30.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I have tried it without span ( just R4, R2 and
IDS sensing interfaces in same vlan ) and with span configured as follows.
Niether has worked.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>monitor session 1 source vlan 20 rx</FONT></DIV>
<DIV><FONT face=Arial size=2>monitor session 1 destination int f0/17 ingress
vlan 20</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Any ideas??</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Dain</FONT></DIV></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>