Using the Netsec feature

[MWLosRios]

I wanted to see how many of you are using the Netsec feature in 6.3.1. I think it has a lot of potential for catching malware and other security problems, but detailed documentation on it is lacking. I've done a lot of my own research on it to determine how to best configure it.

One of the things I have figured out is what the sensitivity paramenter really does. As an example, for the arp-address-scan anomaly, the sensitivity parameter determines what ratio of arp_requests ingress to arp_reply egress packets is necessary to trigger an alert. The default sensitivity of 50 means that there must be twice as many arp_requests in than there are arp_replies out to trigger an alert. A higher sensitivity means that ratio of arp_requests to arp_replies can be closer to 1 (equal amount of requests and replies).

The formula for determining whether arp-address-scan triggers appears to be

arp_requests ingress > count and arp_reply egress < (sensitivty * arp_requests ingress) / 100.

I think the same formula applies to anomalies that are similar, like icmp-address-scan, and syn-failure.

I'm currently running tests with several 6850 switches, with arp-address-scan, icmp-address-scan, syn-failure and tcp-address-scan enabled. I think these four anomalies are the best ones to look at for catching problems.

Let me know what you think and what your experieces are with netsec.

Thanks,
Mark Williams
Network Architect
Los Rios Community College District