Filter
Top Products
A-25
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
SensorApp
•
Event risk rating
Event risk rating helps reduce false positives from the system and gives you more control over what
causes an alarm. The event risk rating incorporates the following additional information beyond the
detection of a potentially malicious action:
–
Severity of the attack if it were to succeed
–
Fidelity of the signature
–
Relevance of the potential attack with respect to the target host
–
Overall value of the target host
SensorApp New Features
The SensorApp contains the following new features:
•
Policy table—Provides a list of risk category settings (high, medium, and low).
•
Evasion protection—Lets an inline interface mode sensor switch from strict mode to asymmetric
mode for the Normalizer.
•
Sensor health meter—Provides sensor-wide health statistics.
•
Top services—Provides the top ten instances of the TCP, UDP, ICMP, and IP protocols.
•
Security meter—Profiles alerts into threat categories and reports this information in red, yellow, and
green buckets. You can configure the transition points for these buckets.
•
Clear Flow state—Lets you clear the database, which causes the sensor to start fresh just as in a
restart.
•
Restart status—Reports periodically the current start and restart stages of the sensor.
Packet Flow
Packets are received by the NIC and placed in the kernel user-mapped memory space by the IPS-shared
driver. The packet is prepended by the IPS header. Each packet also has a field that indicates whether to
pass or deny the packet when it reaches Signature Event Action Processor.
The producer pulls packets from the shared-kernel user-mapped packet buffer and calls the process
function that implements the processor appropriate to the sensor model. The following orders occur:
•
Single processor execution
Time Processor --> Layer 2 Processor --> Deny Filters Processor --> Fragment Reassembly
Processor --> Statistics Processor --> Database Processor --> Signature Analysis Processor -->
Stream Reassembly Processor --> Signature Event Action Processor
•
Dual processor execution
Execution Thread 1 Time Processor --> Layer 2 Processor --> Deny Filters Processor --> Fragment
Reassembly Processor --> Statistics Processor --> Database Processor --> Signature Analysis
Processor --> Slave Dispatch Processor --> | Execution Thread 2 Database Processor --> Stream
Reassembly Processor --> Signature Event Action Processor