Sitemap

Amicuk Programming Answers

New to IPS 4240 - What else can I use to manage it?

-0001-11-30   Views:0

Advertisement

I have just purchased a Cisco IPS 4240 and have it up and running. Have been using the IEV to view IPS information and that works ok. The VMS 2.2 that came included with the IPS will not work with the current Cisco works (LMS 2.5) installation that w

I have just purchased a Cisco IPS 4240 and have it up and running. Have been using the IEV to view IPS information and that works ok. The VMS 2.2 that came included with the IPS will not work with the current Cisco works (LMS 2.5) installation that we have.
My question is, is there any other tool besides the IEV and the VMS 2.2 that I can use to mange/monitor my IPS? the IEV seems so limited.
I have downloaded the newer VMS from the Cisco site and am planning to test that this comming week, but wanted to know ahead of time if I needed to waste my time with this tool or not.
Thanks!

The replay answer
Advertisement
The latest CSMARS release is promising and honestly the netforensics solution offered by Cisco probably wouldn't be a good fit for the op, but I think Cisco needs to rething pushing the MARS in leui of everything else. As a previous customer of netforensics, and now a user of CSMARS...there are definitely many things that netforensics does better than CSMARS.
My biggest beef with CSMARS is the seemingly casual way in which it treats time and "raw messages". IMHO, these should be sacred to any SIM. I can elaborate, but for the sake of brevity I'll just give a couple examples:
The signature name reported in the "raw message" that MARS makes available is not always correct. Also, custom signature events report as "unknown" in the "raw message". Clearly this is not a "raw message" by any reasonable interpretation...MARS is writing bits that never existed in the original message.
the event contextual information is very often truncated. If you rely on this a great deal, the MARS probably isn't for you. There's also no interface for decoding it, requiring a cut-and-paste into your favorite decoder.
Believe me, I could go on. On the bright side, the MARS is showing promise...I was able to cross off my list quite a few issues after the latest upgrade.
Matt

Go to See the other 8 answers

New to IPS 4240 - What else can I use to manage it?

Category:DefaultRelease time:-0001-11-30Views:130

I have just purchased a Cisco IPS 4240 and have it up and running. Have been using the IEV to view IPS information and that works ok. The VMS 2.2 that came included with the IPS will not work with the current Cisco works (LMS 2.5) installation that w[More]

TCP RESET - CISCO IPS 4240 in IDS Mode - Block Teamviewer

Category:DefaultRelease time:2015-10-11Views:130

I would like to block teamviewer in my network. we are using CISCO IPS 4240 in IDS Mode. I found that there are signatures for teamviewer in latest Signatures. We have only configured promiscuous interface, I read that we can issue TCP resets thru pr[More]

IPS 4240 software 6.2(3)E4

Category:DefaultRelease time:2015-10-11Views:130

Hello! I have a sensor IPS-4240 which holds IPS software 6.2(3)E4. Right now we havn't got a license. With the device wh have almost 100% cpu usage all the time: show statistics host General Statistics    Last Change To Host Config (UTC) = 27-Dec-201[More]

Cisco IPS 4240 stops file downloads at 90%

Category:DefaultRelease time:-0001-11-30Views:130

Hi everybody. I have a Cisco IPS 4240 with version 7.0.4 installed and upgraded to the last signature. But since it was installed i have the issue with some file downloads because the IPS stops the file at 90-99% of download percentage (in some cases[More]

Need Information about IPS 4240

Category:DefaultRelease time:-0001-11-30Views:130

Hello, Could you please give me information about IPS 4240: Number of sessions Number of signature Number of protocol Thank you very muchRefer to the following urls for moreinfo on using IPS 4240: http://www.cisco.com/en/US/docs/security/ips/6.0/conf[More]

IPS-4240 Password Recovery

Category:DefaultRelease time:-0001-11-30Views:130

Hi, I have a problem with IPS-4240. Nobody of my workmates knows the password and I read that the only way is to reinstall the version of IOS. Is there any other way to recover the password than reinstalling? thanks. GNU GRUB  version 1.0(11)2  (631K[More]

How to configure IPS 4240 - K9 to send log file to syslog server

Category:DefaultRelease time:-0001-11-30Views:130

I am looking for the commands in how to configure IPS 4240-k9 to send log file to SYSLOG server. If anybody has or came across similer issue please advice. Thanks in advanced.Ali - I am sorry to tell you, but the Cisco IPS Sensors do not send Syslog[More]

Upgrading IPS-4240-K9

Category:DefaultRelease time:-0001-11-30Views:130

Hi,      I have an IPS-4240-K9 with system Version 5.1(8)E2 and I need to upgrade to the last version Release 7.1(7)E4, I need to know if there is some way to do this without jumping from all the old versions (6.0 E2, 6.0 E3, 6.0E4, etc) do i need to[More]

Unable to load IPS 4240 IOS from Rom Mode

Category:DefaultRelease time:-0001-11-30Views:130

Hi Experts, Kindl asist me in load the IPS IOS on the IPS 4240 from rommon mode. Note: I can only access the IPS via rommon only becuase the existing ios is cuppted and formatted. The rommon output is give bellow: rommon #2> set ROMMON Variable Setti[More]

IPS 4240 Design Question

Category:DefaultRelease time:-0001-11-30Views:130

I have two IPS 4240s that may be placed between our internal network and our extranet firewall. The firewall set is your standard ASA-5520 active/failover pair connected to two switches. Q1 - If I am not worried about atomic attacks, is there any oth[More]

IPS 4240 fail open

Category:DefaultRelease time:-0001-11-30Views:130

Hi All, I have a single unit of IPS 4240. I want to know if my sensor or the unit itself fails/shutdowns, is there any option where in my traffic will be passed so that there is no downtime. Thanks PratikYou can configure the sensor when it's inline[More]

Hot
i had synced some 15 gb music onto my 120 GB ipod for a holiday . In my holiday i took some 5 gb of photos which i decided to backup on my ipod. So i put the Ipod to USB into the computer, the ipod device opened from my computer icon, and i copied an [More]
I work for an auditing firm and we have recently gone paperless with our audit documentation. We have our files saved on a server and multiple people can access the same file at one time. We noticed that Acrobat does not give an message notifying a u [More]
If I upgrade my Macbook Air to the newly released ( March, 2015 ), can I do target display mode with my iMac retina 27" ?No. That iMac can't go into Target Display mode. (124301)Read other 2 answers [More]
Os 10.5.3 Can't work with IMovie It start, I have access to preference, font etc etc but to project windows and I can't make new one it's gray. Need help and of course I have trash the pref project and all the basicah, i just found the fix on one of [More]
My mac mini is running slow.  Bought it in 2009.  Activity monitor shows nothing running that should not be.  Someone suggested it might be my operating system?  Check for software updates, and I am current.  Suggestions?Open Activity Monitor, Show:> [More]
I installed the Solaris 10 8/07 dvd from Sun, all drivers appeared to load and patches are up to date. The problem is that I get the message Xserver won't start Upon examination of /var/log/Xorg.0.log I see (EE) unable to locate/open config file. Als [More]
Hi Friends:   kindly see the below program: *& Report  ZSM1                                                        * REPORT  zsm1                                    . TABLES : lfa1,zsm1. SELECTION-SCREEN BEGIN OF BLOCK b1 WITH FRAME TITLE text-001. S [More]
Hello! I have a huge problem. We have a film project that it supposed to be finished soon. We are making a kind of big project. The project is about 10 minutes long. So now I am finished, trying to render but I always get after effects cant make ***X [More]
Hi there, Have just tried buying an album in iTunes on my iPhone 5 and the price tab is greyed out. The album is "clean" yet all the explicit albums price tabs are fine and i can purchase and download fine. Seems a bit back to front to me, any i [More]
It's real simple for anybody but people at Mozilla. MY COMPUTER SHUTS DOWN a few minute after starting FireFox. The Firefox website is broken, and nobody pays attention to anything. In plain english, everything Mozilla bites. Got it now? Not likely.. [More]