18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Configuring alarm events and event responses<br />

17-12 Alarm Events and Responses<br />

traceroute—This command provides information on the gateways<br />

an IP packet must pass through to get to a destination. As input,<br />

the command needs the hostname or IP address <strong>of</strong> the<br />

destination system. It then sends these IP packets from your<br />

<strong>Sidewinder</strong> <strong>G2</strong> to that address. As output, it lists the hostnames<br />

and IP addresses <strong>of</strong> each system the packets were handed <strong>of</strong>f to<br />

and how long it took to send each packet back and forth. This<br />

option is equivalent to entering the following UNIX command:<br />

/usr/sbin/traceroute -m 50 -p 33500 ipaddress<br />

ping: This command determines whether an Internet system is<br />

running by sending packets that the remote system should echo<br />

back. As output, ping lists how much time it took for the<br />

message to travel to the other system and back. This option is<br />

equivalent to entering the following UNIX command:<br />

/bin/ping -c 5 ipaddress<br />

nslookup—This command queries the DNS database to obtain all<br />

<strong>of</strong> the information that is available about a particular address. The<br />

output includes the name and address <strong>of</strong> the DNS server used to<br />

provide the information, the name <strong>of</strong> the system you asked about<br />

and other data that might be available (for example, where e-mail<br />

is delivered for the domain). This option is equivalent to entering<br />

the following UNIX command:<br />

/usr/bin/nslookup -d 2 ipaddress<br />

whois—This command queries the Network Information Center<br />

(NIC) database to obtain information regarding a particular<br />

domain name.<br />

3. To enable the Host Discard field, select the corresponding check box<br />

and specify the amount <strong>of</strong> time (in seconds) that packets from a<br />

particular host will be ignored within a specific burb. If this field is<br />

enabled, when a strikeback occurs, any attempts by the <strong>of</strong>fending<br />

source host to send IP packets will be prevented for the time specified.<br />

Valid values include any positive integer (in seconds). The default value<br />

is 0 (disabled).<br />

Changing other options<br />

This section provides information on additional audit options you can<br />

configure by manually editing the appropriate configuration file.<br />

strikeback_data_ttl—One option you may want to change is the<br />

strikeback_data_ttl using:<br />

cf audit set strikeback.data.ttl=x

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!