Cisco Systems IPS4510K9 manual SensorApp New Features, Packet Flow

Appendix A System Architecture

SensorApp

•Event risk rating

Event risk rating helps reduce false positives from the system and gives you more control over what causes an alarm. The event risk rating incorporates the following additional information beyond the detection of a potentially malicious action:

–Severity of the attack if it were to succeed

–Fidelity of the signature

–Relevance of the potential attack with respect to the target host

–Overall value of the target host

SensorApp New Features

The SensorApp contains the following new features:

•Policy table—Provides a list of risk category settings (high, medium, and low).

•Evasion protection—Lets an inline interface mode sensor switch from strict mode to asymmetric mode for the Normalizer.

•Sensor health meter—Provides sensor-wide health statistics.

•Top services—Provides the top ten instances of the TCP, UDP, ICMP, and IP protocols.

•Security meter—Profiles alerts into threat categories and reports this information in red, yellow, and green buckets. You can configure the transition points for these buckets.

•Clear Flow state—Lets you clear the database, which causes the sensor to start fresh just as in a restart.

•Restart status—Reports periodically the current start and restart stages of the sensor.

Packet Flow

Packets are received by the NIC and placed in the kernel user-mapped memory space by the IPS-shared driver. The packet is prepended by the IPS header. Each packet also has a field that indicates whether to pass or deny the packet when it reaches Signature Event Action Processor.

The producer pulls packets from the shared-kernel user-mapped packet buffer and calls the process function that implements the processor appropriate to the sensor model. The following orders occur:

•Single processor execution

Time Processor --> Layer 2 Processor --> Deny Filters Processor --> Fragment Reassembly Processor --> Statistics Processor --> Database Processor --> Signature Analysis Processor --> Stream Reassembly Processor --> Signature Event Action Processor

•Dual processor execution

Execution Thread 1 Time Processor --> Layer 2 Processor --> Deny Filters Processor --> Fragment Reassembly Processor --> Statistics Processor --> Database Processor --> Signature Analysis Processor --> Slave Dispatch Processor --> Execution Thread 2 Database Processor --> Stream Reassembly Processor --> Signature Event Action Processor

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		A-25