Chapter 2: Configuring and Viewing Appliance Settings
16
Configuring Packet Captures
Introduction
The Proventia A604, A1204, and A1204F appliances can capture attack packets that you
can view and analyze from the SiteProtector management console. The system associates
these captured packets with specific events, which can benefit a forensic investigation.
Where configured
You configure packet captures on the SiteProtector management console.
Overview
To configure packet captures, you must first set the LOGDB response in the Policy Editor
to the LogwithRaw response name. The LOGDB response displays the detected event on
the monitoring console. Together with the Display response, raw data from the
LogWithRaw response is translated into a format that appears in the Event Details
window on the management console. There are two packet capture files:
FirstPacket.enc
and
LastPacket.enc
. These packet capture files display as icons in the Event Details
window, under the Attribute value.
Reference:
For more information about using the Policy Editor, see the
ISS Response,
Policy, and Event Collector Help
.
Setting the
LogwithRaw
response
To set the LOGDB response to LogwithRaw:
1. In the SiteProtector Site Manager, select the appliance.
2. Select
Apply
Policy
.
The Select Policy window opens.
3. Select the policy, and then click
Derive New
.
4. In the Policy Editor window, select the tab for the type of event to which you are
assigning responses.
5. In the signature pane, click the signature to which you want to assign responses.
6. The response list in the right pane displays the responses that are currently assigned
to this signature.
7. Select the check box next to the LOGDB response type.
8. Select the
LogwithRaw
response name.
9. From the
File
menu, select
Save
.
A confirmation message appears.
10. Click
OK
.
11. From the
File
menu, select
Exit
.
12. Select the policy, and then click
OK
.
The policy opens.
13. Verify that the policy is correct, and then click
OK
.
Viewing packet
captures
To view packet captures:
1. In the SiteProtector SiteManager, select the
Network
Sensor
Analysis
tab.
A list of events by tag name appears.
2. Select a row, and then right-click the tag name.
