Promiscuous Mode; Understanding Promiscuous Mode; Understanding Tcp Reset; Configuring Promiscuous Mode - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Promiscuous Mode

Promiscuous Mode
This section describes promiscuous mode on the sensor, and contains the following topics:
•
•
•

Understanding Promiscuous Mode

In promiscuous mode, packets do not flow through the IPS. The sensor analyzes a copy of the monitored
traffic rather than the actual forwarded packet. The advantage of operating in promiscuous mode is that
the IPS does not affect the packet flow with the forwarded traffic. The disadvantage of operating in
promiscuous mode, however, is the IPS cannot stop malicious traffic from reaching its intended target
for certain types of attacks, such as atomic attacks (single-packet attacks). The response actions
implemented by promiscuous IPS devices are post-event responses and often require assistance from
other networking devices, for example, routers and firewalls, to respond to an attack. While such
response actions can prevent some classes of attacks, for atomic attacks, however, the single packet has
the chance of reaching the target system before the promiscuous-based sensor can apply an ACL
modification on a managed device (such as a firewall, switch, or router).

Understanding TCP Reset

You need to designate an alternate TCP reset interface in the following situations:
•
•
•

Configuring Promiscuous Mode

Use the physical-interfaces command in the service interface submode to configure promiscuous
interfaces.
AIP-SSM is configured for promiscuous mode from the ASA CLI and not from the IPS CLI. For the
Note
procedure, see
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
5-4
Understanding Promiscuous Mode, page 5-4
Understanding TCP Reset, page 5-4
Configuring Promiscuous Mode, page 5-4
When a switch is being monitored with either SPAN or VACL capture and the switch does not accept
incoming packets on the SPAN or VACL capture port.
When a switch is being monitored with either SPAN or VACL capture for multiple VLANs, and the
switch does not accept incoming packets with 802.1q headers.
Note The TCP resets need 802.1q headers to tell which VLAN the resets should be sent on.
When a network tap is used for monitoring a connection.
Note Taps do not allow incoming traffic from the sensor.
Configuring ASA to Send IPS Traffic to AIP-SSM, page
Chapter 5 Configuring Interfaces
14-3.
78-16527-01