Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 20: IPS Attack and System Event Responses
Creating IPS attack responses
570
In this configuration, if an intruder launches 5 probe attempts in a 30 second
period, a response is triggered. However, if the intruder sends 5 more
probe attempts during the next 30 seconds, Sidewinder G2 will not send
another alert. However, if the response calls for a Strikeback (see next section),
traffic will continue to be blackholed.
After five minutes, if the threshold is again reached, another alert will be
triggered.
• Configure Strikeback — Sidewinder G2 can blackhole, or ignore, traffic
from a host that is sending suspect traffic.
Caution:Sidewinder G2 blackholes based on source address, as opposed to
traffic type. If you choose to blackhole a host, all traffic from that host will be
ignored.
– Blackhole: Select this option to ignore all traffic from the suspect traffic’s
source(s) for a set time period. The source of the attack is recorded in
the audit event’s attack_ip field. The source of the suspect traffic may
be the connection’s source IP address (a peer or a client) or destination
IP address (if a server is attacking a client). If Sidewinder G2 considers
it likely that the source IP address could have been forged, it will leave
the attack_ip field blank and not blackhole any IP address for this audit
event. The apparent source and destination IP address is still recorded
in the audit event.
If you select the Blackhole option, you must also specify for how long
you want to blackhole traffic.
• Blackhole packets for x seconds where x is a value between 1 and
100000.
Tip: If you find you need to blackhole traffic for more than 100,000
seconds (a little over 24 hours), consider creating an IP Filter deny rule for
that traffic.
– All attacking hosts: Select this option to blackhole all hosts involved in
triggering the alert. For example, if you want an alert after 5 occurrences
in 30 seconds and host A sent 4 occurrences and host B sent 1, all
traffic from hosts A and B would be ignored for the set amount of time.
– Each host responsible for y% of the attacks: Select this option to limit
blackholing on a percentage basis. For example, if you set the
percentage at 50% and host A caused 4 out of 5 attacks and host B
caused 1 out of 5 attacks, only traffic from host A would be ignored.