TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
There can be false positives related to the TFN2K signature - most of the
false positives deal strictly with dns traffic. ISS is currently addressing
this problem and will come out with an X-Press Update to fix it in the near
future. Another feature in the works for the ext RealSecure Network Sensor
is the an event filter capability to turn off a particular decode for a
specific machine and/or port in the policy.
Thanks for the comments - we're listening!
Audra
-----Original Message-----
From: Neil Long [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 03, 2000 3:19 AM
To: Jared Tabb; Joe Blow; [EMAIL PROTECTED]
Subject: Re: RealSecure v5.0 and False Positives
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Just to confirm a similar blizzard of false TFN2000 alerts - again a
mix of genuine DNS udp requests and audio/video streams (bbc.co.uk does
it here).
How does anyone get hold of the Xpress Updates if the management
console is on a non-routeable network (i.e. secure out of band)?
If I use a non-master console which I could temporarily connect to
routeable feed then the Xpress_Updates option disappears off the sensor
menu.
Is the MicroUpdate 1.1 for v5.0 available other than via the console
app?
Thanks
Neil
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dr Neil J Long, Computing Services, University of Oxford
13 Banbury Road, Oxford, OX2 6NN, UK Tel:+44 1865 273232 Fax:+44 1865
273275
EMail: [EMAIL PROTECTED]
PGP: ID 0xE88EF71F OxCERT: [EMAIL PROTECTED] PGP: ID 0x4B11561D
