Viavi Apex Enterprise G3-APEX-ENT-32T, Руководство пользователя

Страница: 239 / 380

Examining your network traffic with forensic analysis
Chapter 9: Forensic Analysis 239
Field Description
Normalize directory traversal—Directory traversal attacks
attempt to access unauthorized directories and commands on
a web server or application by using the /./ and /../ syntax. This
preprocessor removes directory traversals and self-referential
directories. You may want to disable logging for occurrences
of this, as many web pages and applications use directory
traversals to reference content.
Normalize multiple slashes to one—Another directory traversal
strategy is to attempt to confuse the web server with excessive
multiple slashes.
Normalize Backslash—This option emulates IIS treatment of
backslashes (i.e., converts them to forward slashes).
ARP Inspection Ethernet uses Address Resolution Protocol (ARP) to map IP
addresses to a particular machine (MAC) addresses. Rather
than continuously broadcasting the map to all devices on the
segment, each device maintains its own copy, called the ARP
cache, which is updated whenever the device receives an ARP
Reply. Hackers use cache poisoning to launch man-in-the-
middle and denial of service (DoS) attacks. The ARP inspection
preprocessor examines ARP traffic for malicious forgeries (ARP
spoofing) and the traffic resulting from these types of attacks.
Log preprocessor events—Checking this box causes forensic
analysis to save any alerts generated by the ARP Inspection
preprocessor to the log, but not the Forensic Summary Window.
Report non-broadcast requests—Non-broadcast ARP traffic
can be evidence of malicious intent. Once scenario is the hacker
attempting to convince a target computer that the hacker’s
computer is a router, thus allowing the hacker to monitor all
traffic from the target. However, some devices (such as printers)
use non-broadcast ARP requests as part of normal operation.
Start by checking the box to detect such traffic; disable the
option only if analysis detects false positives.
Telnet
Normalization
Hackers may attempt to evade detection by inserting control
characters into Telnet and FTP commands aimed at a target. This
pre-processor strips these codes, thus normalizing all such traffic
before subsequent forensic rules are applied.
Log preprocessor events—Checking this box causes
forensic analysis to save any alerts generated by the Telnet
Normalization preprocessor to the log, but not the Forensic
Summary Window.
Port List—Lets you specify a list of ports to include or exclude
from Telnet pre-processing. The default settings are appropriate
for most networks.
Variable Name A scrollable window located below the preprocessor settings
lists the variables that were imported along with the Snort rules.
Variables are referenced by the rules to specify local and remote
network ranges, and common server IP addresses and ports. You
can edit variable definitions by double-clicking on the variable
you want to edit.
The VRT Rule Set variable settings (and those of most publicly-
distributed rule sets) will work on any network without
modification, but you can dramatically improve performance
by customizing these variables to match the network being