Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 398 / 1026

Configuring False Positives
Select a false positive setting that indicates the frequency (Unknown, Rarely, Occasionally,
or Frequently) the attack object produces a false positive on your network. Although you
might not have this information when you initially configure the custom attack object,
as you fine-tune your system to your network traffic you can change this setting to help
you track false positives.
Configuring Service Binding (IDP Attack Objects Only)
For IDP attack objects, select the service that the attack uses to enter your network. You
must select a service other than “ Any” if you want to chose a service context for the
attack object.
NOTE: For DI attack objects, you do not select a service binding. However,
for custom DI attack objects, you can select a service binding.
• Any—If you are unsure of the correct service, select Any and DI attempts to match the
signature in all services. Because some attacks use multiple services to attack your
network, you might want to select the Any service binding to detect the attack regardless
of which service the attack chooses for a connection.
• IP—If you are not sure of the correct service but know the IP protocol type, select IP
for the service binding. You can specify the name of the protocol type, or the protocol
type number. If you select IP as the service type, you should also specify an attack
pattern (in the Detection area) and IP settings values (in the IP area). Additionally, if
you use a context binding of first packet, you must leave the attack pattern empty.
Table 34 on page 348 lists the supported protocol types.
Table 34: IP Protocol Name and Type Numbers
Protocol Type Number Protocol Name
2 IGMP
4 IPIP
8 EGP
12 PUP
29 TP
41 IPV6
43 ROUTING
44 FRAGMENT
46 RSVP
Copyright © 2010, Juniper Networks, Inc. 348
Network and Security Manager Administration Guide