Glossary
GL-11
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
intrusion detection
system
IDS. A security service that monitors and analyzes system events to find and provide real- time or near
real-time warning of attempts to access system resources in an unauthorized manner.
IP address
32-bit address assigned to hosts using TCP/IP. An IP address belongs to one of five classes (A, B, C,
D, or E) and is written as 4 octets separated by periods (dotted decimal format). Each address consists
of a network number, an optional subnetwork number, and a host number. The network and subnetwork
numbers together are used for routing, and the host number is used to address an individual host within
the network or subnetwork. A subnet mask is used to extract network and su bnetwork information from
the IP address.
IPS
Intrusion Prevention System. A system that alerts the user to the presence of an intrusion on the network
through network traffic analysis techniques.
IPS data or message
Describes the messages transferred over the command and control interface between IPS applications.
iplog
A log of the binary packets to and from a designated address. Iplogs are created when the log Event
Action is selected for a signature. Iplogs are stored in a libpcap format, which can be read by WireShark
and TCPDUMP.
IP spoofing
IP spoofing attack occurs when an attacker o utside your network pretends to be a trusted user either by
using an IP address that is within the range of IP addresses for your network or by using an authorized
external IP address that you trust and to which you want to provide access to specified resources on
your network. Should an attacker get access to your IPSec securit y parameters, that attacker can
masquerade as the remote user authorized to connect to the corporate network.
IPv6
IP version 6. Replacement for the current version of IP (version 4). IPv6 includes support for flow ID
in the packet header, which can be used to identify flows. Formerly called IPng (next generation).
ISL
Inter-Switch Link. Cisco-proprietary protocol that maintains VLAN information as traffic flows
between switches and routers.
J
Java Web Start
Java Web Start provides a platform-independent, secure, and robust deployment technology. It enables
developers to deploy full-featured applications to you by making the applications available on a
standard web server. With any web browser, you can launch the applications and be confident you
always have the most-recent version.
JNLP
Java Network Launching Protocol. Defined in an XML file format specifying how Java Web Start
applications are launched. JNLP consists of a set of rules defining how exactly the launching
mechanism should be implemented.
K
KB
Knowledge Base. The sets of thresholds learned by Anomaly Detection and used for worm virus
detection.
Knowledge Base
See KB.