Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 7: Configuring Network Defenses
Viewing Network Defense information
Viewing Network
Defense
information
208
Network Defenses allow you to control the audit output for suspicious traffic
detected by Sidewinder G2, automatically preventing that traffic from passing
from one burb to another. Some traffic is stopped because a packet, or
sequence of packets, resembles a known attack. Other traffic is stopped
because a packet does not comply with its protocol’s standards.
Options for what audit to generate include:
• Audit for packets that Sidewinder G2 determines to be part of an identifiable
attack can be audited based on attack description (bad header length, bad
redirect, etc.).
• Audit for packets that are not specifically identified as a potential attack can
be audited at the following levels:
– All packets that do not comply with their protocol’s standards
– Packets that do not comply with their protocol’s standards and have
been identified as a severe or moderate risk to your network
– Packets that do not comply with their protocol’s standards and have
been identified as a severe risk to your network
– Do not generate audit when Sidewinder G2 stops a packet because it
does not comply to its protocol’s standard
Network Defenses represent one element of Sidewinder G2’s audit
capabilities. Information about additional auditing tools can be found in the
following chapters:
• Chapter 18, "Monitoring"
• Chapter 19, "Auditing and Reporting"
• Chapter 20, "IPS Attack and System Event Responses"