12-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter12 C onfiguring IP Logging
Understanding IP Logging
Understanding IP Logging
You can manually configure the sensor to capture all IP traffic associated with a host you specify by IP
address. You can specify how long you want the IP traffic to be logged, how many packets you want
logged, and how many bytes you want logged. The sensor stops logging IP tra ffic at the first parameter
you specify.
You can also have the sensor log IP packets every time a particular signature is fired. You can specify
how long you want the sensor to log IP traffic and how many packets and bytes you want logged.
You can copy the IP logs from the sensor and have them analyzed by a tool that can read packet files in
a libpcap format, such as Wireshark or TCP DUMP.
Note
Each alert references IP logs that are created because of that alert. If multiple alerts create IP logs for
the same IP address, only one IP log is created for all the alerts. Each alert references the same IP log.
However, the output of the IP log status only shows the event ID of the first alert triggering the IP log.
Note
IP logging allows a maximum limit of 20 concurrent IP log files. Once the limit of 20 is reach ed, you
receive the following message in main.log:
Cid/W errWarnIpLogProcessor::addIpLog: Ran out of
file descriptors
.
Configuring Automatic IP Logging
Use the ip-log-packets number, ip-log-time number, and ip-log-bytes number commands to configure
automatic IP logging parameters on the sensor.
The following options apply:
•
ip-log-packets—Identifies the number of packets you want logged. The valid value is 0 to 65535.
The default is 0.
•
ip-log-time—Identifies the duration you want the sensor to log packets. The valid value is 0 to
65535 minutes. The default is 30 minutes.
•
ip-log-bytes —Identifies the maximum number of bytes you want logged. The valid value is 0 to
2147483647. The default is 0.
•
default—Resets the parameters.
Note
An automatic IP log continues capturing packets until one of these para meters is reached.
Automatic IP logging is configured on a per signature basis or as an event action override. The following
actions trigger automatic IP logging:
•
log-attacker-packets
•
log-victim-packets
•
log-pair-packets