topic Re: IPS - set up packet logging in General Topics

IPS - set up packet logging

Samir.Belkessam — Thu, 15 Nov 2012 18:13:51 GMT

Dears,

I would like to know if there is a possibility to collect some packets before and after the packet that trigged the attack signature

it will be helpful in case of troubleshooting and confirm if this attack is a false positive or real attack( knowing that this option is available from other vendors )

Thanks and regards

Samir.

Re: IPS - set up packet logging

mikand — Fri, 16 Nov 2012 09:18:40 GMT

When you setup a profile for the IPS in Objects -> Security Profiles -> Vulnerability Protection you can define if packet capture should be performed or not (either globally like a group of threatid's or specific threatid's).

I cant find any info in the manual if packets from before the packet that triggered the attack signature will be part of this pcap.

Re: IPS - set up packet logging

Samir.Belkessam — Fri, 16 Nov 2012 18:17:53 GMT

Thanks Mikand for you reply, is there someone who can clarify us on this ?