In your policy for IPUnknownProtocol, go to the Advanced Properties and there is a field where you can enter protocol numbers to be ignored by this alert. ESP is protocol # 50.
Brian Fitch Systems Engineer Internet|Security|Systems -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 19, 2003 11:08 AM To: [EMAIL PROTECTED] Subject: [ISSForum] realsecure IDS 6.5 I am using RealSecure 6.5 network sensors with a Workgroup Manager. I am getting a lot of alerts for "IPunknown Protocol". I know that this event is being raised because of esp protocol being used on our network. Can anyone tell me how I can create a filter for realsecure to ignore this traffic. any help appreciated, Shay. ======================== Shay Broderick ClearStream Services & +352 44992 6096 [EMAIL PROTECTED] ======================== Visit us at http://www.clearstream.com IMPORTANT MESSAGE Internet communications are not secure and therefore Clearstream International does not accept legal responsibility for the contents of this message. The information contained in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any views expressed in this e-mail are those of the individual sender, except where the sender specifically states them to be the views of Clearstream International or of any of its affiliates or subsidiaries. END OF DISCLAIMER _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
