5-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Chapter 5 Configuring Interfaces
Promiscuous Mode
Promiscuous Mode
This section describes promiscuous mode on the sensor, and contains the following topics:
•
Understanding Promiscuous Mode, page 5-4
•
Understanding TCP Reset, page 5-4
•
Configuring Promiscuous Mode, page 5-4
Understanding Promiscuous Mode
In promiscuous mode, packets do not flow through the IPS. The sensor analyzes a copy of the monitored
traffic rather than the actual forwarded packet. The advantage of operating in promiscuous mode is that
the IPS does not affect the packet flow with the forwarded traffic. The disadvantage of operating in
promiscuous mode, however, is the IPS cannot stop malicious traffic from reaching its intended target
for certain types of attacks, such as atomic attacks (single-packet attacks). The response actions
implemented by promiscuous IPS devices are post-event responses and often require assistance from
other networking devices, for example, routers and firewalls, to respond to an attack. While such
response actions can prevent some classes of attacks, for atomic attacks, however, the single packet has
the chance of reaching the target system before the promiscuous-based sensor can apply an ACL
modification on a managed device (such as a firewall, switch, or router).
Understanding TCP Reset
You need to designate an alternate TCP reset interface in the following situations:
•
When a switch is being monitored with either SPAN or VACL capture and the switch does not accept
incoming packets on the SPAN or VACL capture port.
•
When a switch is being monitored with either SPAN or VACL capture for multiple VLANs, and the
switch does not accept incoming packets with 802.1q headers.
Note
The TCP resets need 802.1q headers to tell which VLAN the resets should be sent on.
•
When a network tap is used for monitoring a connection.
Note
Taps do not allow incoming traffic from the sensor.
Configuring Promiscuous Mode
Use the
physical-interfaces
command in the service interface submode to configure promiscuous
interfaces.
Note
AIP-SSM is configured for promiscuous mode from the ASA CLI and not from the IPS CLI. For the
procedure, see
Configuring ASA to Send IPS Traffic to AIP-SSM, page 14-3
.