Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 428 / 588

21-8
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Constructing a Rule
Destination IP IP address of the packet destination. Often referred to as the target.
Variables ANY —(Default). Signifies that the
IP address for each count is any IP
address.
SAME— Signifies that the IP address
for each count is the same IP address.
This variable is local to its offset.
DISTINCT— Signifies that the IP
address for each count is a unique IP
address. This variable is local to its
offset.
$Target01 to $Target20— The same
variable in another field or offset
signifies
that the IP address for each
count is the same IP address.
Network Groups— Defined network groups—
Topologically valid network groups as
defined under Management > IP
Management.
Networks — Topologically valid network groups as
defined under Management > IP
Management.
Devices— The hosts and reporting
devices present in the system.
The hosts and reporting devices
present in the system.
IP addresses— IP addresses present on devices in the
system or user entered dotted quads.
IP ranges— The range of addresses
between two dotted quads.
The range of addresses between two
dotted quads.
Service Name A TCP/IP-based network service, identified by protocol and port, defined
within the packet.
Table 21-1 Rule Fields and Arguments
Rule Field Field Description and Arguments Argument Descriptions