Force10-networks PSeries 100-00055-01 User Manual Page 68
- Page / 132
- Table of contents
- BOOKMARKS
Rated. / 5. Based on customer reviews
68 Writing Rules
Writing Stateful Rules
Stateful matching improves the accuracy of detection because it adds ordering when specifying behaviors
across multiple matching events. State transitions in the P-Series follow a non-cyclic pattern; no state
transitions may erase any of the previous states. New state transitions are simply recorded via a
non-destructive, additive operation.
As new states are produced, they are bitwise “OR-ed” with the current states contained in the per-flow
register C
f
., which is 16 bits wide. This method is different from stateful matching in software systems,
where old state is removed after a set amount of time. It allows a deterministic wire-speed state
management algorithm while guaranteeing that no match events are ever lost due to resource constraints.
Figure 38 shows the state matching algorithm. Note that the only time some state is erased is in the case of
a timeout.
Figure 38 State Management Algorithm
New Packet
Calculate Cf
Address
Bitwise OR
Cf | new state
Update Cf
Cf
Timed out
New Flow
yes
yes
fn9000017
C[0]=1
Stateful Matching
Each signature i contains a pattern matching expression m
i
that is compared to the incoming data stream in
real time (time t). In addition, each signature may contain - at your discretion - three values, s, c, and r,
which respectively specify:
• The pre-match state condition necessary for
the signature to match (in addition to m
i
)
• The post-match state condition applied after the signature has
matched
• A directive indicating what to
do with the matched packet
The s an
d c values are used to manage a per-flow register C
f
, where the subscript f is the flow, or
sub-stream, and the r value is used to direct the packet storage.
- P-Series Installation and 1
- Operation Guide 1
- Contents 3
- Appendix E 6
- Appendix F 6
- Preface About this Guide 7
- Information Symbols 8
- Related Documents 8
- Additional Resources 8
- Chapter 1 Installation 9
- System Specifications 10
- Physical Connections 10
- Configuration 12
- Security Check 12
- Upgrading Software 12
- Chapter 2 Getting Started 15
- 16 Getting Started 16
- Chapter 3 Introduction 17
- Types of Rules 18
- Sample Rules and Firmware 18
- Rule Management 19
- Deploying the P-Series 19
- Inline Deployment 20
- Fail-safe Deployment 20
- Highly-available Deployment 21
- Passive Deployment 21
- Capturing Matched Traffic 22
- Capturing to a Host CPU 23
- Mirroring to Another Device 24
- GUI Commands 26
- PNIC0 Not Active 27
- To modify dynamic rules: 29
- 30 Graphical User Interface 30
- Figure 16 30
- Figure 17 30
- Capture/Forward Policies GUI 30
- Runtime Statistics 31
- 32 Graphical User Interface 32
- Figure 19 32
- Figure 20 32
- Reloading Firmware 33
- 34 Graphical User Interface 34
- (see Appendix A , on page 36
- Monitoring System Performance 38
- Managing Firmware Images 39
- 40 Web-based Management 40
- Managing Policies 41
- 42 Web-based Management 42
- Sguil Server 43
- Sguil Clie 43
- P-Series Sensors 43
- Installing the Sguil System 44
- Installing the Sguil Client 45
- Installation Files 46
- Running the Sguil System 47
- Running the Sguil Server 48
- Running the Sguil Client 49
- Figure 33 appears 50
- CLI Commands 51
- MAC Rewriting 51
- Removing VLAN Tags 53
- 54 Command Line Interface 54
- Chapter 8 Compiling Rules 55
- Enter command gmake from 58
- Selecting Yes is recommended 59
- Summary of configuration 60
- Firmware Filenames 62
- Compiler Errors 62
- Chapter 9 Writing Rules 63
- Protocol 64
- Source Addresses 64
- Direction Operator 65
- P-Series Rule Syntax 66
- Writing Stateful Rules 68
- Stateful Rule Examples 70
- Handling Segmentation Evasion 71
- Anomalous TCP Flags 73
- 74 Writing Rules 74
- Chapter 10 Firewall 75
- Enabling the Firewall 76
- 90 Appendix A 90
- Figure 55 91
- 92 Appendix A 92
- Figure 56 92
- Disable the physical link 93
- [channel] 93
- Enable the physical link 93
- Information 95
- 0/pnic_{0 98
- [number] 103
- [number] 104
- • Stop capturing and matching 104
- Stop the Sguil sensor 107
- • Load the runtime parameters 110
- [root@localhost SW]# 112
- 114 Appendix A 114
- Stop the web server 116
- Related 117
- Commands 117
- 118 Appendix A 118
- Appendix B Snort Keywords 119
- 122 Appendix B 122
- Table 30 123
- 124 Appendix C 124
- Unix Commands 125
- Appendix E Glossary 127
- Appendix F Technical Support 129
- Step Task 131
- 132 Technical Support 132
Related products and manuals for Hardware Force10-networks PSeries 100-00055-01
(105 pages)Saeco HD8854/14 manuals
Owner’s manuals and user’s guides for Coffee making accessories Saeco HD8854/14.
We providing 1 pdf manuals Saeco HD8854/14 for download free by document types: User Manual
Comments to this Manuals