TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Now, that is an interesting statement, since as you say some devices may
accidental trigger RS events, one must be very aware of the network
architecture and how the ISS RealSecure Policy is crafted. One can
trigger many false positives by having such protocols as HSRP or other
High Availability or IP-Sharing devices on a network. Look at the details
of the IPDuplicate event, if it caused by the use of these protocols, you
can certainly create an exception list with a custom connection event and
not report the event if it is caused by the network protocols that are
deployed.
There are simpler solutions in solving the statement below, but that will
be left as an exercise for the reader/lurker.. :)
/m
"Mark Clancy" <[EMAIL PROTECTED]>
Sent by: [EMAIL PROTECTED]
04/08/00 08:57 AM
To: <[EMAIL PROTECTED]>
cc:
Subject: RE: IPDuplicate -reply - DO NOT FILTER EVENT
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
One other thing is if you have devices that are in high availability modes
like routers with HSRP that can trigger RS events. Same IP different MAC
addresses.
As noted before you should investigate, but this might help narrow it
down.
-Mark
