150 Responding
Setting response actions
in the custom response dialog. No characters following the %* are interpreted,
so a % is acceptable in a password.
Escaping the % directive
If you need to pass a % as the first character of an argument and do not want it
to be interpreted as a replacement directive preface the % with another %. For
example %s will be interpreted as a directive to replace this argument with the
source address:port list, but %%s will be passed directly as %s and not
interpreted.
Setting a TCP reset response action
The TCP reset response action directs Symantec Network Security to terminate
a TCP connection to prevent further damage from an attack. The minimum
delay between responses is 0.
To enable TCP resets
1
In the Network Security console, click
Configuration
>
Response Rules
.
2
In
Response Rules
, click the
Response Action
column of a rule.
3
In
Configure Response Action
, click
TCP Reset
.
4
Provide the following information:
■
Maximum number of TCP resets
: Enter the number of TCP resets per
incident of this response.
■
Delay between sending TCP resets (mins)
: Enter the time in minutes
that you want Symantec Network Security to wait per incident, before
sending another TCP reset.
5
In
Configure Response Action
, click
OK
to save and exit.
6
In
Response Rules
, click
OK
to save and exit.
Setting traffic record response action
The traffic record response dynamically records network traffic in response to
an event. With this option, Symantec Network Security can record traffic for a
specified period of time, or until a specified number of packets has been
collected.
The traffic record response action begins recording traffic when triggered. It
continues to record based on the number of minutes and the number of packets
specified in the response configuration. Traffic recording stops when either
limit is reached, whichever comes first. If the maximum number of packets is
Summary of Contents for 10521146 - Network Security 7120
Page 1: ...Symantec Network Security Administration Guide...
Page 12: ...12 Contents Index...
Page 14: ...14...
Page 70: ...70...
Page 110: ...110 Populating the topology database Adding nodes and objects...
Page 158: ...158 Responding Managing flow alert rules...
Page 188: ...188...
Page 242: ...242 Reporting Playing recorded traffic...
Page 268: ...268 Managing log files Exporting data...
Page 316: ...316 Advanced configuration Configuring advanced parameters...
Page 318: ...318...
Page 338: ...338 SQL reference Using MySQL tables...
Page 366: ...366 Glossary...
Page 392: ...392 Index...
