Writing Rules | Force10 Networks 100-00055-01 guide

74	Writing Rules

Image 74

Force10 Networks 100-00055-01 manual Writing Rules

Contents

Series Installation and Operation Guide Copyright 2008 Force10 Networks Contents Contents Graphical User Interface Command Line Reference Glossary Conventions ObjectivesAudience Convention Description Keyword Related Documents Information SymbolsSymbol Warning Description Additional Resources Label Description This LED is blue when the hard disk is accessedThis LED is green when the power is on This LED is not used PB-10GE-2P System SpecificationsPhysical Connections Step Task Once the appliance is booted BootingConfiguration Security Check Tar xvzf PTPS-PMAIN Gmake installCp -Rf /usr/local/pnic/ /home Cd SW Re-compile all rules firmware with the new compiler Cd upgradedirectory/pnic-compilerInstall pre-compiled firmware if needed Located in the directory pnic-compiler Returning to the Default Configuration Chapter Getting Started Getting Started Chapter Introduction Hardware Architecture Overview Rx1 Tx1 Mirror Types of RulesSample Rules and Firmware Introduction Sample Rules Files Rule ManagementDeploying the P-Series Rule Set Description Inline Deployment Fail-safe Deployment Highly-available Deployment Passive Deployment Capturing Matched Traffic Series supports capturing matched traffic for analysis Capturing to a Host CPU Capturing Matched Traffic via the libpcap Interface Mirroring to Another Device Creating an IDS Accelerator with the P-Series Invoke the GUI by entering the command pnic gui Graphical User Interface Command Description GUI CommandsGUI Commands Managing Rules, Policies, and Firmware Rule Management GUI Policy Capture Editing Dynamic Rules with the GUIOption Description Permit Deny Managing Capture/Forward Policies with the GUI To modify dynamic rules Selecting Firmware with the GUI Managing Capture/Forward Policies GUI Select Manage Firmware see Figure Runtime StatisticsTo select firmware Runtime Statistics for Channel 0 and 1-FPGA Loaded Statistic Description Reloading FirmwareRuntime Statistics Description Graphical User Interface Web-based Management Launching the P-Series Node Manager Lauching the P-Series Node Manager Web-based Management Series Node Manager has four major management capabilities Managing the P-Series using Node ManagerWeb-browser Security Certificates Monitoring System Performance Series Node Manager Home Panel Web-based Management Managing Firmware Images Managing the Network Interface CardPage Managing Policies Page Network Security Monitoring Installing the Sguil Server Installing the Sguil SystemInstalling the Sguil Sensor Source the server configuration file. The default Installing the Sguil ClientTo uninstall the server Wish File Location Sensor Installation FilesSguil Files and Directories Server Running the Sguil System Running the Sguil Sensor Running the Sguil Server Task Script Running the Sguil Client To run the Sguil Client Selecting the Sensor to Monitor MAC Rewriting CLI CommandsEditing Dynamic Rules with the CLI Change directories to /usr/local/pnic/0 Command Line Interface Rewriting Destination MAC Addresses to Load Balance Removing Vlan Tags Command Line Interface Compiling Rules Creating Rules FilesRules Capacity To complile rules Compilation Option Description Content matching Positives Enter command gmake from pnic-compilerdirectory Pnic-Compiler Option Summary of configuration Starting and Stopping the pnic-Compiler File Description Location Configuration and Generated FilesConfiguration and Generated Files Describes each of the elements in this format Compiler ErrorsFirmware Filenames Firmware Filename Description Snort Rule Syntax Snort Rule SyntaxSnort Rule Headers Protocol Ports Snort Rule Options Series Rule SyntaxSeries Supported Snort Keywords Keyword Static Dynamic Yes Yes, no ranges Seq YesYes Only /8/16/24/32 masks Writing Stateful Rules Stateful Matching Pre-match Condition the S Value Stateful Rule Examples Support for Snorts flow Keyword Handling Segmentation Evasion Support for Snorts within Keyword Anomalous TCP Flags Writing Rules Chapter Firewall Deploying the P-Series as a Firewall Enabling the Firewall Firewall Allowing Traffic through the Firewall Writing Rules for a Firewall Deployment Sample Firewall Rules Appendix a Command Line Reference Appendix a Pnic aggregate-mode-disablePnic aggregate-mode-disable number Different ports. This is the default behavior Pnic aggregate-mode-enablePnic aggregate-mode-enable number Pnic apply-firmware Pnic apply-firmware Command Example Display the available firmware Pnic capture-off Pnic capture-offPnic capture-on Syntax pnic capture-on Pnic cardstatus number Display the configuration parameters of the systemPnic cardstatus Display the driver version Pnic compilerules Pnic default-drop-disablePnic default-drop-disable number Pnic compilerules number Run diagnostic tests on the card Pnic default-drop-enableEnable firewall functionality Pnic diag Pnic diag Command Example Example pnic diag Command Example Pnic flow-teardown-disable Pnic flow-teardown-disablePnic flow-teardown-enable Pnic flow-teardown-enable Pnic getmachashindex number Example pnic flow-teardown-enable Command ExamplePnic getmachashindex Syntax pnic gui Pnic guiLaunch the graphical user interface Pnic gui Command Example Pnic help Pnic help Pnic linkdown Pnic linkup Pnic loadconf Pnic loadconf number Pnic loadconf Address Mapping Address Corresponding Parameter Load the PCI-X and front-end EEPROMs Pnic loadepromsPnic loadparams deprecated Pnic loadeproms number Pnic loadparams Command Example Loadparams Address Mapping Pnic loadrules Pnic loadrules channel Disable MAC rewriting using the command pnic macrewrite-off Disable MAC rewriting. This is the default behaviorEnable MAC rewriting using the command pnic macrewrite-on Pnic macrewrite-off 100 Appendix a Pnic off deprecatedSyntax pnic off Pnic on deprecated Example pnic off Command ExampleEnable the capturing of packets via direct memory access Pnic on Pnic params Pnic passive-mode-disableSyntax pnic passive-mode-disable number Pnic params number Example pnic passive-mode-disable Command Example Pnic passive-mode-enableConfigure the ports to only receive traffic Configure the ports to only receive traffic Pnic restart Pnic resetconfPnic resetconf number Stop capturing and matching Start the Sguil sensor Series Installation and Operation Guide, version 105Pnic sguil-sensor-start Pnic restart Pnic sguil-sensor-start -f Stop the Sguil sensor Series Installation and Operation Guide, version 107Pnic sguil-sensor-stop Pnic sguil-sensor-stop -f Pnic show-firmwares Display configuration parameters of the cardPnic showconf List the available firmware images Apply a specific firmware to the card Series Installation and Operation Guide, version 109Pnic showtech Pnic showtech number filename.dat Pnic start Disable the network interface using the command pnic stopExample pnic showtech Command Example Pnic start number Disable the network interface Turn off capture and disable the network interfaceEnable the network interface using the command pnic start Pnic stop Disable temporary memory Pnic temp-mem-disablePnic temp-mem-enable Enable temporary memory. This is the default behavior Pnic updatemacvalue number Pnic updatemacvalueDisable temporary memory Specifies an LSB value for a particular hash index Disable the Vlan Tag Remove feature Pnic vlan-remove-disablePnic vlan-remove-enable Vlan Tag Remove feature is disabled by default Pnic web-gui-start Disable the web server using the command pnic web-gui-stopPnic version Display the driver version Stop the web server Pnic web-gui-stopStop the web server Pnic web-gui-stop -f Series Installation and Operation Guide, version 117 Start the web server 118 Appendix a Ack Checks for a specific TCP acknowledgment number Description of P-Series Snort KeywordsKeyword Description Rule Syntax Flags!*+ FSRPAU120 Icmp seq number Flow establishedstatelessIcmp idnumber Ipproto ! name number Uricontent ! datastring Ttl This keyword checks for the specified IP time-to-live 122 Appendix B Evasion Rules Meta Rules for Channel 0 and ChannelMeta Rules 124 Appendix C Passwd Unix CommandsLogout Pwd Set number no Vi Commands? text Number Garbage Dynamic RulesFlow Collection State SnortSpan Port Static Rules Manual Pages Accessing iSupport ServicesSeries Installation and Operation Guide, version 129 ISupport Website Contacting the Technical Assistance Center Locating P-Series Serial Numbers Requesting a Hardware Replacement To request replacement hardware, follow these steps 132 Technical Support