Feedback
Table Of Contents
Administrative Tasks for the Sensor
Clearing Events from the Event Store
Clearing the Denied Attackers List
Displaying Tech Support Information
Displaying Version Information
Directing Output to a Serial Connection
Diagnosing Network Connectivity
Tracing the Route of an IP Packet
Administrative Tasks for the Sensor
This chapter contains procedures that will help you with the administrative aspects of your sensor. It contains the following sections:
•
Modifying Terminal Properties
•
•
•
•
•
•
•
Creating a Banner Login
Use the banner login command to create a banner login that will be displayed before the user and password login prompts. The maximum message length is 2500 characters. Use the no banner login command to remove the banner.
To create a banner login, follow these steps:
Step 1
Step 2
sensor# configure terminalStep 3
sensor(config)# banner loginBanner[]:Step 4
Banner[]: This message will be displayed on banner login. ^M Thank yousensor(config)#
Note
Example of a completed banner login:
This message will be displayed on login.Thank youlogin: ciscoPassword:****Step 5
sensor(config)# no banner loginThe banner no longer appears at login.
Terminating CLI Sessions
Use the clear line cli-id [message] command to terminate another CLI session. If you use the message keyword, you can send a message along with the termination request to the receiving user. The maximum message length is 2500 characters.
The following options apply:
•
•
Caution
If an administrator tries to log in when the maximum sessions have been reached, the following message appears:
Error: The maximum allowed CLI sessions are currently open, would you like to terminate one of the open sessions? [no]If an operator or viewer tries to log in when the maximum sessions are open, the following message appears:
Error: The maximum allowed CLI sessions are currently open, please try again later.To terminate a CLI session, follow these steps:
Step 1
Step 2
sensor# show usersCLI ID User Privilege* 13533 jtaylor administrator15689 jsmith operator20098 viewer viewerStep 3
sensor# clear line cli_id messageMessage[]:Example:
sensor# clear line 15689 messageMessage{}: Sorry! I need to terminate your session.sensor#Step 4
sensor#********* Termination request from jtaylor***Sorry! I need to terminate your session.
Modifying Terminal Properties
Use the terminal [length] screen length command to modify terminal properties for a login session. The screen length option lets you set the number of lines that appear on the screen before the --
more--prompt is displayed. A value of zero results in no pause in the output. The default value is 24 lines.
Note
To modify the terminal properties, follow these steps:
Step 1
Step 2
sensor# terminal length 0
Note
Step 3
more--prompt every 10 lines, use 10 for the screen length value:sensor# terminal length 10
Events
This section describes how to display and clear events from the Event Store, and contains the following topics:
•
Displaying Events
Use the show events [{[alert [informational] [low] [medium] [high] [include-traits traits] [exclude-traits traits]] | error [warning] [error] [fatal] | NAC | status}] [hh:mm:ss [month day [year]] | past hh:mm:ss] command to display events from the Event Store.
Events are displayed beginning at the start time. If you do not specify a start time, events are displayed beginning at the current time. If you do not specify an event type, all events are displayed.
Note
The following options apply:
•
If no level is selected (informational, low, medium, or high), all alert events are displayed.
•
•
•
•
•
•
•
•
Note
To display events from the Event Store, follow these steps:
Step 1
Step 2
sensor#@ show eventsevError: eventId=1041472274774840147 severity=warning vendor=Ciscooriginator:hostId: sensor2appName: cidwebserverappInstanceId: 12075time: 2003/01/07 04:41:45 2003/01/07 04:41:45 UTCerrorMessage: name=errWarning received fatal alert: certificate_unknownevError: eventId=1041472274774840148 severity=error vendor=Ciscooriginator:hostId: sensor2appName: cidwebserverappInstanceId: 351time: 2003/01/07 04:41:45 2003/01/07 04:41:45 UTCerrorMessage: name=errTransport WebSession::sessionTask(6) TLS connection exception: handshake incomplete.The feed continues showing all events until you press Ctrl-C.
Step 3
sensor#@ show events NAC 10:00:00 Feb 9 2005evShunRqst: eventId=1106837332219222281 vendor=Ciscooriginator:deviceName: Sensor1appName: NetworkAccessControllerAppappInstance: 654time: 2005/02/09 10:33:31 2004/08/09 13:13:31shunInfo:host: connectionShun=falsesrcAddr: 11.0.0.1destAddr:srcPort:destPort:protocol: numericType=0 othertimeoutMinutes: 40evAlertRef: hostId=esendHost 123456789012345678sensor#Step 4
sensor# show events error warning 10:00:00 Feb 9 2005evError: eventId=1041472274774840197 severity=warning vendor=Ciscooriginator:hostId: sensorappName: cidwebserverappInstanceId: 12160time: 2003/01/07 04:49:25 2003/01/07 04:49:25 UTCerrorMessage: name=errWarning received fatal alert: certificate_unknownStep 5
sensor# show events alert past 00:00:45evIdsAlert: eventId=1109695939102805307 severity=medium vendor=Ciscooriginator:hostId: sensorappName: sensorAppappInstanceId: 367time: 2005/03/02 14:15:59 2005/03/02 14:15:59 UTCsignature: description=Nachi Worm ICMP Echo Request id=2156 version=S54subsigId: 0sigDetails: Nachi ICMPinterfaceGroup:vlan: 0participants:attacker:addr: locality=OUT 10.89.228.202target:addr: locality=OUT 10.89.150.185riskRatingValue: 70interface: fe0_1protocol: icmpevIdsAlert: eventId=1109695939102805308 severity=medium vendor=Ciscooriginator:--MORE--Step 6
sensor# show events past 00:00:30evStatus: eventId=1041526834774829055 vendor=Ciscooriginator:hostId: sensorappName: mainAppappInstanceId: 2215time: 2003/01/08 02:41:00 2003/01/08 02:41:00 UTCcontrolTransaction: command=getVersion successful=truedescription: Control transaction response.requestor:user: cidsapplication:hostId: 64.101.182.101appName: -cidcliappInstanceId: 2316evStatus: eventId=1041526834774829056 vendor=Ciscooriginator:hostId: sensorappName: login(pam_unix)appInstanceId: 2315time: 2003/01/08 02:41:00 2003/01/08 02:41:00 UTCsyslogMessage:description: session opened for user cisco by cisco(uid=0)
Clearing Events from the Event Store
Use the clear events command to clear Event Store.
To clear events from Event Store, follow these steps:
Step 1
Step 2
sensor# clear eventsWarning: Executing this command will remove all events currently stored in the event store.Continue with clear? []:Step 3
System Clock
This section explains how to display and manually set the system clock. It contains the following topics:
Displaying the System Clock
Use the show clock [detail] command to display the system clock. You can use the detail option to indicate the clock source (NTP or system) and the current summertime setting (if any).
The system clock keeps an authoritative flag that indicates whether the time is authoritative (believed to be accurate). If the system clock has been set by a timing source, such as NTP, the flag is set.
*
Time is not authoritative.
(blank)
Time is authoritative.
.
Time is authoritative, but NTP is not synchronized.
To display the system clock, follow these steps:
Step 1
Step 2
sensor# show clock22:39:21 UTC Sat Jan 25 2003Step 3
sensor# show clock detail22:39:21 CST Sat Jan 25 2003Time source is NTPSummer time starts 02:00:00 CST Sun Apr 7 2004Summer time ends 02:00:00 CDT Sun Oct 27 2004This indicates that the sensor is getting its time from NTP and that is configured and synchronized.
sensor# show clock detail*12:19:22 CST Sat Dec 04 2004No time sourceSummer time starts 02:00:00 CST Sun Apr 7 2004Summer time ends 02:00:00 CDT Sun Oct 27 2004This indicates that no time source is configured.
Manually Setting the Clock
Use the clock set hh:mm [:ss] month day year command to manually set the clock on the appliance. Use this command if no other time sources are available.
Note
For the procedure for configuring NTP, see Configuring NTP. For an explanation of the importance of having a valid time source for the sensor, see Time Sources and the Sensor. For an explanation of what to do if you set the clock incorrectly, see Correcting Time on the Sensor.
The clock set command does not apply to the following platforms:
•
•
•
•
To manually set the clock on the appliance, follow these steps:
Step 1
Step 2
sensor# clock set 13:21 July 29 2004
Note
Clearing the Denied Attackers List
Use the clear denied-attackers command in service event action rules submode to delete the denied attackers list and clear the virtual sensor statistics.
If your sensor is configured to operate in inline mode, the traffic is passing through the sensor. You can configure signatures to deny packets, connections, and attackers while in inline mode, which means that single packets, connections, and specific attackers will be denied, that is, not transmitted, when the sensor encounters them.
When the signature fires, the attacker is denied and placed in a list. As part of sensor administration, you may want to delete the list or clear the statistics in the list.
To delete the list of denied attackers and clear the statistics, follow these steps:
Step 1
Step 2
sensor# show statistics denied-attackersDenied Attackers and hit count for each.10.20.4.2 = 910.20.5.2 = 5The statistics show that there are two IP addresses being denied at this time.
Step 3
sensor# clear denied-attackersWarning: Executing this command will delete all addresses from the list ofattackers currently being denied by the sensor.Continue with clear? [yes]:Step 4
Step 5
sensor# show statistics virtual-sensorVirtual Sensor StatisticsStatistics for Virtual Sensor vs0Name of current Signature-Definition instance = sig0Name of current Event-Action-Rules instance = rules0List of interfaces monitored by this virtual sensor = mypairDenied Address InformationNumber of Active Denied Attackers = 0Number of Denied Attackers Inserted = 2Number of Denied Attackers Total Hits = 287Number of times max-denied-attackers limited creation of new entry = 0Number of exec Clear commands during uptime = 1Denied Attackers and hit count for each.There is no longer any information under the
Denied Attackers and hit count for each category.Step 6
sensor# show statistics virtual-sensor clearStep 7
JWK-4255# show statistics virtual-sensorVirtual Sensor StatisticsStatistics for Virtual Sensor vs0Name of current Signature-Definition instance = sig0Name of current Event-Action-Rules instance = rules0List of interfaces monitored by this virtual sensor = mypairDenied Address InformationNumber of Active Denied Attackers = 2Number of Denied Attackers Inserted = 0Number of Denied Attackers Total Hits = 0Number of times max-denied-attackers limited creation of new entry = 0Number of exec Clear commands during uptime = 1Denied Attackers and hit count for each.10.20.2.5 = 010.20.5.2 = 0The statistics have all been cleared except for the Number of Active Denied Attackers and Number of exec Clear commands during uptime categories. It is important to know if the list has been cleared.
Displaying Statistics
Use the show statistics virtual-sensor [clear] command to display the statistics for the virtual sensor. Use the show statistics [analysis-engine | authentication | denied-attackers | event-server | event-store | host | logger | network-access | notification | sdee-server | transaction-server | transaction-source | web-server] [clear] command to generate statistics for each of the sensor applications.
Note
To display statistics for the sensor, follow these steps:
Step 1
Step 2
sensor# show statistics virtual-sensorVirtual Sensor StatisticsStatistics for Virtual Sensor vs0Name of current Signature-Definition instance = sig0Name of current Event-Action-Rules instance = rules0List of interfaces monitored by this virtual sensor = fe0_1General Statistics for this Virtual SensorNumber of seconds since a reset of the statistics = 1675Measure of the level of resource utilization = 0Total packets processed since reset = 241Total IP packets processed since reset = 12Total packets that were not IP processed since reset = 229Total TCP packets processed since reset = 0Total UDP packets processed since reset = 0Total ICMP packets processed since reset = 12Total packets that were not TCP, UDP, or ICMP processed since reset = 0Total ARP packets processed since reset = 0Total ISL encapsulated packets processed since reset = 0Total 802.1q encapsulated packets processed since reset = 0Total packets with bad IP checksums processed since reset = 0Total packets with bad layer 4 checksums processed since reset = 0Total number of bytes processed since reset = 22513The rate of packets per second since reset = 0The rate of bytes per second since reset = 13The average bytes per packet since reset = 93Denied Address InformationNumber of Active Denied Attackers = 0Number of Denied Attackers Inserted = 0Number of Denied Attackers Total Hits = 0Number of times max-denied-attackers limited creation of new entry = 0Number of exec Clear commands during uptime = 0Denied Attackers and hit count for each.The Signature Database Statistics.The Number of each type of node active in the system (can not be reset)Total nodes active = 0TCP nodes keyed on both IP addresses and both ports = 0UDP nodes keyed on both IP addresses and both ports = 0IP nodes keyed on both IP addresses = 0The number of each type of node inserted since resetTotal nodes inserted = 28TCP nodes keyed on both IP addresses and both ports = 0UDP nodes keyed on both IP addresses and both ports = 0IP nodes keyed on both IP addresses = 6The rate of nodes per second for each time since resetNodes per second = 0TCP nodes keyed on both IP addresses and both ports per second = 0UDP nodes keyed on both IP addresses and both ports per second = 0IP nodes keyed on both IP addresses per second = 0The number of root nodes forced to expire because of memory constraintsTCP nodes keyed on both IP addresses and both ports = 0Fragment Reassembly Unit Statistics for this Virtual SensorNumber of fragments currently in FRU = 0Number of datagrams currently in FRU = 0Number of fragments received since reset = 0Number of fragments forwarded since reset = 0Number of fragments dropped since last reset = 0Number of fragments modified since last reset = 0Number of complete datagrams reassembled since last reset = 0Fragments hitting too many fragments condition since last reset = 0Number of overlapping fragments since last reset = 0Number of Datagrams too big since last reset = 0Number of overwriting fragments since last reset = 0Number of Initial fragment missing since last reset = 0Fragments hitting the max partial dgrams limit since last reset = 0Fragments too small since last reset = 0Too many fragments per dgram limit since last reset = 0Number of datagram reassembly timeout since last reset = 0Too many fragments claiming to be the last since last reset = 0Fragments with bad fragment flags since last reset = 0TCP Normalizer stage statisticsPackets Input = 0Packets Modified = 0Dropped packets from queue = 0Dropped packets due to deny-connection = 0Current Streams = 0Current Streams Closed = 0Current Streams Closing = 0Current Streams Embryonic = 0Current Streams Established = 0Current Streams Denied = 0Statistics for the TCP Stream Reassembly UnitCurrent Statistics for the TCP Stream Reassembly UnitTCP streams currently in the embryonic state = 0TCP streams currently in the established state = 0TCP streams currently in the closing state = 0TCP streams currently in the system = 0TCP Packets currently queued for reassembly = 0Cumulative Statistics for the TCP Stream Reassembly Unit since resetTCP streams that have been tracked since last reset = 0TCP streams that had a gap in the sequence jumped = 0TCP streams that was abandoned due to a gap in the sequence = 0TCP packets that arrived out of sequence order for their stream = 0TCP packets that arrived out of state order for their stream = 0The rate of TCP connections tracked per second since reset = 0SigEvent Preliminary Stage StatisticsNumber of Alerts received = 491Number of Alerts Consumed by AlertInterval = 0Number of Alerts Consumed by Event Count = 0Number of FireOnce First Alerts = 6Number of FireOnce Intermediate Alerts = 480Number of Summary First Alerts = 0Number of Summary Intermediate Alerts = 0Number of Regular Summary Final Alerts = 0Number of Global Summary Final Alerts = 0Number of Alerts Output for further processing = 491SigEvent Action Override Stage StatisticsNumber of Alerts received to Action Override Processor = 0Number of Alerts where an override was applied = 0Actions Addeddeny-attacker-inline = 0deny-connection-inline = 0deny-packet-inline = 0modify-packet-inline = 0log-attacker-packets = 0log-pair-packets = 0log-victim-packets = 0produce-alert = 0produce-verbose-alert = 0request-block-connection = 0request-block-host = 0request-snmp-trap = 0reset-tcp-connection = 0SigEvent Action Filter Stage StatisticsNumber of Alerts received to Action Filter Processor = 0Number of Alerts where an action was filtered = 0Number of Filter Line matches = 0Actions Filtereddeny-attacker-inline = 0deny-connection-inline = 0deny-packet-inline = 0modify-packet-inline = 0log-attacker-packets = 0log-pair-packets = 0log-victim-packets = 0produce-alert = 0produce-verbose-alert = 0request-block-connection = 0request-block-host = 0request-snmp-trap = 0reset-tcp-connection = 0SigEvent Action Handling Stage Statistics.Number of Alerts received to Action Handling Processor = 491Number of Alerts where produceAlert was forced = 0Number of Alerts where produceAlert was off = 0Actions Performeddeny-attacker-inline = 0deny-connection-inline = 0deny-packet-inline = 0modify-packet-inline = 0log-attacker-packets = 0log-pair-packets = 0log-victim-packets = 0produce-alert = 11produce-verbose-alert = 0request-block-connection = 0request-block-host = 5request-snmp-trap = 0reset-tcp-connection = 0Deny Actions Requested in Promiscuous Modedeny-packet not performed = 0deny-connection not performed = 0deny-attacker not performed = 0modify-packet not performed = 0Number of Alerts where deny-connection was forced for deny-packet action = 0Number of Alerts where deny-packet was forced for non-TCP deny-connection action = 0Per-Signature SigEvent count since resetSig 2004 = 5Sig 2156 = 486sensor#Step 3
sensor# show statistics analysis-engineAnalysis Engine StatisticsNumber of seconds since service started = 1999Measure of the level of current resource utilization = 0Measure of the level of maximum resource utilization = 0The rate of TCP connections tracked per second = 0The rate of packets per second = 0The rate of bytes per second = 13Receiver StatisticsTotal number of packets processed since reset = 290Total number of IP packets processed since reset = 12Transmitter StatisticsTotal number of packets transmitted = 290Total number of packets denied = 0Total number of packets reset = 0Fragment Reassembly Unit StatisticsNumber of fragments currently in FRU = 0Number of datagrams currently in FRU = 0TCP Stream Reassembly Unit StatisticsTCP streams currently in the embryonic state = 0TCP streams currently in the established state = 0TCP streams currently in the closing state = 0TCP streams currently in the system = 0TCP Packets currently queued for reassembly = 0The Signature Database Statistics.Total nodes active = 0TCP nodes keyed on both IP addresses and both ports = 0UDP nodes keyed on both IP addresses and both ports = 0IP nodes keyed on both IP addresses = 0Statistics for Signature EventsNumber of SigEvents since reset = 491Statistics for Actions executed on a SigEventNumber of Alerts written to the IdsEventStore = 11sensor#Step 4
sensor# show statistics authenticationGeneraltotalAuthenticationAttempts = 2failedAuthenticationAttempts = 0sensor#Step 5
sensor# show statistics denied-attackersDenied Attackers and hit count for each.sensor#Step 6
sensor# show statistics event-serverGeneralopenSubscriptions = 0blockedSubscriptions = 0Subscriptionssensor#Step 7
sensor# show statistics event-storeEvent store statisticsGeneral information about the event storeThe current number of open subscriptions = 2The number of events lost by subscriptions and queries = 0The number of queries issued = 0The number of times the event store circular buffer has wrapped = 0Number of events of each type currently storedDebug events = 0Status events = 9904Log transaction events = 0Shun request events = 61Error events, warning = 67Error events, error = 83Error events, fatal = 0Alert events, informational = 60Alert events, low = 1Alert events, medium = 60Alert events, high = 0sensor#Step 8
sensor# show statistics hostGeneral StatisticsLast Change To Host Config (UTC) = 16:11:05 Thu Feb 10 2005Command Control Port Device = FastEthernet0/0Network Statisticsfe0_0 Link encap:Ethernet HWaddr 00:0B:46:53:06:AAinet addr:10.89.149.185 Bcast:10.89.149.255 Mask:255.255.255.128UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:1001522 errors:0 dropped:0 overruns:0 frame:0TX packets:469569 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:57547021 (54.8 MiB) TX bytes:63832557 (60.8 MiB)Interrupt:9 Base address:0xf400 Memory:c0000000-c0000038NTP Statisticsstatus = Not applicableMemory UsageusedBytes = 500592640freeBytes = 8855552totalBytes = 509448192Swap UsageUsed Bytes = 77824Free Bytes = 600649728Total Bytes = 600727552CPU StatisticsUsage over last 5 seconds = 0Usage over last minute = 1Usage over last 5 minutes = 1Memory StatisticsMemory usage (bytes) = 500498432Memory free (bytes) = 894976032Auto Update StatisticslastDirectoryReadAttempt = N/AlastDownloadAttempt = N/AlastInstallAttempt = N/AnextAttempt = N/Asensor#Step 9
sensor# show statistics loggerThe number of Log interprocessor FIFO overruns = 0The number of syslog messages received = 11The number of <evError> events written to the event store by severityFatal Severity = 0Error Severity = 64Warning Severity = 35TOTAL = 99The number of log messages written to the message log by severityFatal Severity = 0Error Severity = 64Warning Severity = 24Timing Severity = 311Debug Severity = 31522Unknown Severity = 7TOTAL = 31928sensor#Step 10
sensor# show statistics network-accessCurrent ConfigurationLogAllBlockEventsAndSensors = trueEnableNvramWrite = falseEnableAclLogging = falseAllowSensorBlock = falseBlockMaxEntries = 11MaxDeviceInterfaces = 250NetDeviceType = PIXIP = 10.89.150.171NATAddr = 0.0.0.0Communications = ssh-3desNetDeviceType = PIXIP = 10.89.150.219NATAddr = 0.0.0.0Communications = ssh-desNetDeviceType = PIXIP = 10.89.150.250NATAddr = 0.0.0.0Communications = telnetNetDeviceType = CiscoIP = 10.89.150.158NATAddr = 0.0.0.0Communications = telnetBlockInterfaceInterfaceName = ethernet0/1InterfaceDirection = outInterfacePostBlock = Post_Acl_TestBlockInterfaceInterfaceName = ethernet0/1InterfaceDirection = inInterfacePreBlock = Pre_Acl_TestInterfacePostBlock = Post_Acl_TestNetDeviceType = CAT6000_VACLIP = 10.89.150.138NATAddr = 0.0.0.0Communications = telnetBlockInterfaceInterfaceName = 502InterfacePreBlock = Pre_Acl_TestBlockInterfaceInterfaceName = 507InterfacePostBlock = Post_Acl_TestStateBlockEnable = trueNetDeviceIP = 10.89.150.171AclSupport = Does not use ACLsVersion = 6.3State = ActiveFirewall-type = PIXNetDeviceIP = 10.89.150.219AclSupport = Does not use ACLsVersion = 7.0State = ActiveFirewall-type = ASANetDeviceIP = 10.89.150.250AclSupport = Does not use ACLsVersion = 2.2State = ActiveFirewall-type = FWSMNetDeviceIP = 10.89.150.158AclSupport = uses Named ACLsVersion = 12.2State = ActiveNetDeviceIP = 10.89.150.138AclSupport = Uses VACLsVersion = 8.4State = ActiveBlockedAddrHostIP = 22.33.4.5Vlan =ActualIp =BlockMinutes =HostIP = 21.21.12.12Vlan =ActualIp =BlockMinutes =HostIP = 122.122.33.4Vlan =ActualIp =BlockMinutes = 60MinutesRemaining = 24NetworkIP = 111.22.0.0Mask = 255.255.0.0BlockMinutes =sensor#Step 11
sensor# show statistics notificationGeneralNumber of SNMP set requests = 0Number of SNMP get requests = 0Number of error traps sent = 0Number of alert traps sent = 0sensor#Step 12
sensor# show statistics sdee-serverGeneralOpen Subscriptions = 0Blocked Subscriptions = 0Maximum Available Subscriptions = 5Maximum Events Per Retrieval = 500Subscriptionssensor#Step 13
sensor# show statistics transaction-serverGeneraltotalControlTransactions = 35failedControlTransactions = 0sensor#Step 14
sensor# show statistics transaction-sourceGeneraltotalControlTransactions = 0failedControlTransactions = 0sensor#Step 15
sensor# show statistics web-serverlistener-443number of server session requests handled = 61number of server session requests rejected = 0total HTTP requests handled = 35maximum number of session objects allowed = 40number of idle allocated session objects = 10number of busy allocated session objects = 0crypto library version = 6.0.3sensor#Step 16
sensor# show statistics logger clearThe number of Log interprocessor FIFO overruns = 0The number of syslog messages received = 141The number of <evError> events written to the event store by severityFatal Severity = 0Error Severity = 14Warning Severity = 142TOTAL = 156The number of log messages written to the message log by severityFatal Severity = 0Error Severity = 14Warning Severity = 1Timing Severity = 0Debug Severity = 0Unknown Severity = 28TOTAL = 43The statistics were retrieved and cleared.
Step 17
sensor# show statistics loggerThe number of Log interprocessor FIFO overruns = 0The number of syslog messages received = 0The number of <evError> events written to the event store by severityFatal Severity = 0Error Severity = 0Warning Severity = 0TOTAL = 0The number of log messages written to the message log by severityFatal Severity = 0Error Severity = 0Warning Severity = 0Timing Severity = 0Debug Severity = 0Unknown Severity = 0TOTAL = 0sensor#The statistics all begin from 0.
Displaying Tech Support Information
Use the show tech-support [page] [password] [destination-url destination-url] command to display system information on the screen or have it sent to a specific URL. You can use the information as a troubleshooting tool with TAC.
The following parameters are optional:
•
Press Enter to display the next line of output or use the spacebar to display the next page of information.
•
•
•
To display tech support information, follow these steps:
Step 1
Step 2
sensor# show tech-support pageThe system information appears on the screen, one page at a time. Press the spacebar to view the next page or press Ctrl-C to return to the prompt.
Step 3
a.
sensor# show tech-support destination-url destination-urlYou can specify the following destination types:
•
ftp:[[//username@location]/relativeDirectory]/filenameorftp:[[//username@location]//absoluteDirectory]/filename.•
scp:[[//username@]location]/relativeDirectory]/filenameorscp:[[//username@]location]//absoluteDirectory]/filename.For example, to send the tech support output to the file
/absolute/reports/sensor1Report.html:sensor# show tech support dest ftp://csidsuser@10.2.1.2//absolute/reports/sensor1Report.htmlThe
password:prompt appears.b.
The
Generating report:message is displayed.
Displaying Version Information
Use the show version command to display version information for all installed operating system packages, signature packages, and IPS processes running on the system. To view the configuration for the entire system, use the more current-config command.
To display the version and configuration, follow these steps:
Step 1
Step 2
sensor# show versionThe following examples show sample version output for the appliance and the NM-CIDS.
Sample version output for the appliance:
sensor# show versionApplication Partition:Cisco Intrusion Prevention System, Version 5.0(0.29)S135.0OS Version 2.4.26-IDS-smp-bigphysPlatform: IPS-4255-K9Serial Number: JAB0815R017No license presentSensor up-time is 5 days.Using 722145280 out of 3974291456 bytes of available memory (18% usage)system is using 17.3M out of 29.0M bytes of available disk space (59% usage)application-data is using 36.3M out of 166.8M bytes of available disk space (23% usage)boot is using 39.4M out of 68.6M bytes of available disk space (61% usage)MainApp 2005_Feb_18_03.00 (Release) 2005-02-18T03:13:47-0600 RunningAnalysisEngine 2005_Feb_18_03.00 (Release) 2005-02-18T03:13:47-0600 RunningCLI 2005_Feb_18_03.00 (Release) 2005-02-18T03:13:47-0600Upgrade History:IDS-K9-maj-5.0-0.29-S91-0.29-.pkg 03:00:00 UTC Mon Feb 16 2004Recovery Partition Version 1.1 - 5.0(0.29)S91(0.29)sensor#Sample version output for NM-CIDS:
nm-cids# show versionApplication Partition:Cisco Intrusion Prevention System, Version 5.0(0.27)S129.0OS Version 2.4.26-IDS-smp-bigphysPlatform: NM-CIDSSerial Number: JAD06490681No license presentSensor up-time is 1 day.Using 485675008 out of 509448192 bytes of available memory (95% usage)system is using 17.3M out of 29.0M bytes of available disk space (59% usage)application-data is using 31.1M out of 166.8M bytes of available disk space (20% usage)boot is using 39.5M out of 68.6M bytes of available disk space (61% usage)application-log is using 529.6M out of 2.8G bytes of available disk space (20% usage)MainApp 2005_Feb_09_03.00 (Release) 2005-02-09T03:22:27-0600 RunningAnalysisEngine 2005_Feb_09_03.00 (Release) 2005-02-09T03:22:27-0600 RunningCLI 2005_Feb_09_03.00 (Release) 2005-02-09T03:22:27-0600Upgrade History:IDS-K9-maj-5.0-0.27-S91-0.27-.pkg 03:00:00 UTC Thu Feb 05 2004Recovery Partition Version 1.1 - 5.0(0.27)S91(0.27)nm-cids#
Note
—-MORE-—prompt is displayed, press the spacebar to see more information or Ctrl-C to cancel the output and get back to the CLI prompt.Step 3
Note
sensor# more current-config! ------------------------------! Version 5.0(0.26)! Current configuration last modified Wed Feb 16 03:20:54 2005! ------------------------------display-serial! ------------------------------service analysis-engineexit! ------------------------------service authenticationexit! ------------------------------service event-action-rules rules0exit! ------------------------------service hostnetwork-settingshost-ip 10.89.147.31/25,10.89.147.126host-name sensoraccess-list 0.0.0.0/0login-banner-text This message will be displayed on banner login.exittime-zone-settings--MORE--
Directing Output to a Serial Connection
Use the display-serial command to direct all output to a serial connection. This lets you view system messages on a remote console (using the serial port) during the boot process. The local console is not available as long as this option is enabled. Use the no display-serial command to reset the output to the local terminal.
Caution
The display-serial command does not apply to the following platforms:
•
•
•
•
•
•
•
To direct output to the serial port, follow these steps:
Step 1
Step 2
sensor# configure terminalsensor(config)# display-serialThe default is not to direct the output to a serial connection.
Step 3
sensor(config)# no display-serial
Diagnosing Network Connectivity
Use the ping ip-address [count] command to diagnose basic network connectivity.
Caution
To diagnose basic network connectivity, follow these steps:
Step 1
Step 2
sensor# ping ip-address countThe count is the number of echo requests to send. If you do not specify a number, 4 requests are sent. The range is 1 to 10,000.
Example of a successful ping:
sensor# ping 10.89.146.110 6PING 10.89.146.110 (10.89.146.110): 56 data bytes64 bytes from 10.89.146.110: icmp_seq=0 ttl=61 time=0.3 ms64 bytes from 10.89.146.110: icmp_seq=1 ttl=61 time=0.1 ms64 bytes from 10.89.146.110: icmp_seq=2 ttl=61 time=0.1 ms64 bytes from 10.89.146.110: icmp_seq=3 ttl=61 time=0.2 ms64 bytes from 10.89.146.110: icmp_seq=4 ttl=61 time=0.2 ms64 bytes from 10.89.146.110: icmp_seq=5 ttl=61 time=0.2 ms--- 10.89.146.110 ping statistics ---6 packets transmitted, 6 packets received, 0% packet lossround-trip min/avg/max = 0.1/0.1/0.3 msExample of an unsuccessful ping:
sensor# ping 172.21.172.1 3PING 172.21.172.1 (172.21.172.1): 56 data bytes--- 172.21.172.1 ping statistics ---3 packets transmitted, 0 packets received, 100% packet losssensor#
Resetting the Appliance
Use the reset [powerdown] command to gracefully shut down the applications running on the appliance and to reboot the appliance. You can include the powerdown option to power off the appliance, if possible, or to have the appliance left in a state where the power can be turned off.
Note
Shut down (stopping the applications) begins immediately after you execute the command. Shutdown can take a while, and you can still access CLI commands while it is taking place, but the session will be terminated without warning.
To reset the appliance, follow these steps:
Step 1
Step 2
sensor# resetWarning: Executing this command will stop all applications and reboot the node.Continue with reset? []:Step 3
sensor# yesRequest Succeeded.sensor#Step 4
sensor# reset powerdownWarning: Executing this command will stop all applications and power off the node if possible. If the node can not be powered off it will be left in a state that is safe to manually power down.Continue with reset? []:Step 5
sensor# yesRequest Succeeded.sensor#
Displaying Command History
Use the show history command to obtain a list of the commands you have entered in the current menu. The maximum number of commands in the list is 50.
To obtain a list of the commands you have used recently, follow these steps:
Step 1
Step 2
sensor# show historyclear lineconfigure terminalshow historyStep 3
sensor# configure terminalsensor (config)# service network-accesssensor (config-net)# show historyshow settingsshow settings terseshow settings | include profile-name|ip-addressexitshow historysensor (config-net)#
Displaying Hardware Inventory
Use the show inventory command to display PEP information. This command displays the UDI information that consists of the PID, the VID, and the SN of your sensor.
PEP information provides an easy way to obtain the hardware version and serial number through the CLI.
The show inventory command does not apply to the following platforms:
•
•
•
•
•
•
To display PEP information, follow these steps:
Step 1
Step 2
sensor# show inventoryName: "Chassis", DESCR: "IPS 4255 Intrusion Prevention Sensor"PID: IPS-4255-K9, VID: V01 , SN: JAB0815R017Name: "Power Supply", DESCR: ""PID: ASA-180W-PWR-AC, VID: V01 , SN: 123456789ABsensor#sensor# show inventoryName: "Module", DESCR: "ASA 5500 Series Security Services Module-20"PID: AIP-SSM-20, VID: V01 , SN: JAB0815R036sensor#sensor-4240# show inventoryName: "Chassis", DESCR: "IPS 4240 Appliance Sensor"PID: IPS-4240-K9, VID: V01 , SN: P3000000653sensor-4240#You can use this information when dealing with the TAC.
Tracing the Route of an IP Packet
Use the trace ip_address count command to display the route an IP packet takes to a destination. The ip_address option is the address of the system to trace the route to. The count option lets you define how many hops you want to take. The default is 4. The valid values are 1 to 256.
Caution
To trace the route of an IP packet, follow these steps:
Step 1
Step 2
sensor# trace 10.1.1.1traceroute to 10.1.1.1 (10.1.1.1), 4 hops max, 40 byte packets1 10.89.130.1 (10.89.130.1) 0.267 ms 0.262 ms 0.236 ms2 10.89.128.17 (10.89.128.17) 0.24 ms * 0.399 ms3 * 10.89.128.17 (10.89.128.17) 0.424 ms *4 10.89.128.17 (10.89.128.17) 0.408 ms * 0.406 mssensor#Step 3
sensor# trace 10.1.1.1 8traceroute to 10.1.1.1 (10.1.1.1), 8 hops max, 40 byte packets1 10.89.130.1 (10.89.130.1) 0.35 ms 0.261 ms 0.238 ms2 10.89.128.17 (10.89.128.17) 0.36 ms * 0.344 ms3 * 10.89.128.17 (10.89.128.17) 0.465 ms *4 10.89.128.17 (10.89.128.17) 0.319 ms * 0.442 ms5 * 10.89.128.17 (10.89.128.17) 0.304 ms *6 10.89.128.17 (10.89.128.17) 0.527 ms * 0.402 ms7 * 10.89.128.17 (10.89.128.17) 0.39 ms *8 10.89.128.17 (10.89.128.17) 0.37 ms * 0.486 mssensor#
Displaying Submode Settings
Use the show settings [terse] command in any submode to view the contents of the current configuration.
To display the current configuration settings for a submode, follow these steps:
Step 1
Step 2
sensor# configure terminalsensor (config)# service network-accesssensor (config-net)# show settingsgeneral-----------------------------------------------log-all-block-events-and-errors: true <defaulted>enable-nvram-write: false <defaulted>enable-acl-logging: false <defaulted>allow-sensor-block: false <defaulted>block-enable: true <defaulted>block-max-entries: 250 <defaulted>max-interfaces: 250 default: 250master-blocking-sensors (min: 0, max: 100, current: 0)----------------------------------------------------------------------------------------------never-block-hosts (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------never-block-networks (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------block-hosts (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------block-networks (min: 0, max: 250, current: 0)---------------------------------------------------------------------------------------------------------------------------------------------user-profiles (min: 0, max: 250, current: 11)-----------------------------------------------profile-name: 2admin-----------------------------------------------enable-password: <hidden>password: <hidden>username: pix default:-----------------------------------------------profile-name: r7200-----------------------------------------------enable-password: <hidden>password: <hidden>username: netrangr default:-----------------------------------------------profile-name: insidePix-----------------------------------------------enable-password: <hidden>password: <hidden>username: <defaulted>-----------------------------------------------profile-name: qatest-----------------------------------------------enable-password: <hidden>password: <hidden>username: <defaulted>-----------------------------------------------profile-name: fwsm-----------------------------------------------enable-password: <hidden>password: <hidden>username: pix default:-----------------------------------------------profile-name: outsidePix-----------------------------------------------enable-password: <hidden>password: <hidden>username: pix default:-----------------------------------------------profile-name: cat-----------------------------------------------enable-password: <hidden>password: <hidden>username: <defaulted>-----------------------------------------------profile-name: rcat-----------------------------------------------enable-password: <hidden>password: <hidden>username: cisco default:-----------------------------------------------profile-name: nopass-----------------------------------------------enable-password: <hidden>password: <hidden>username: <defaulted>-----------------------------------------------profile-name: test-----------------------------------------------enable-password: <hidden>password: <hidden>username: pix default:-----------------------------------------------profile-name: sshswitch-----------------------------------------------enable-password: <hidden>password: <hidden>username: cisco default:----------------------------------------------------------------------------------------------cat6k-devices (min: 0, max: 250, current: 1)-----------------------------------------------ip-address: 10.89.147.61-----------------------------------------------communication: telnet default: ssh-3desnat-address: 0.0.0.0 <defaulted>profile-name: catblock-vlans (min: 0, max: 100, current: 1)-----------------------------------------------vlan: 1-----------------------------------------------pre-vacl-name: <defaulted>post-vacl-name: <defaulted>--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------router-devices (min: 0, max: 250, current: 1)-----------------------------------------------ip-address: 10.89.147.54-----------------------------------------------communication: telnet default: ssh-3desnat-address: 0.0.0.0 <defaulted>profile-name: r7200block-interfaces (min: 0, max: 100, current: 1)-----------------------------------------------interface-name: fa0/0direction: in-----------------------------------------------pre-acl-name: <defaulted>post-acl-name: <defaulted>--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------firewall-devices (min: 0, max: 250, current: 2)-----------------------------------------------ip-address: 10.89.147.10-----------------------------------------------communication: telnet default: ssh-3desnat-address: 0.0.0.0 <defaulted>profile-name: insidePix-----------------------------------------------ip-address: 10.89.147.82-----------------------------------------------communication: ssh-3des <defaulted>nat-address: 0.0.0.0 <defaulted>profile-name: f1----------------------------------------------------------------------------------------------sensor (config-net)#Step 3
sensor(config-net)# show settings tersegeneral-----------------------------------------------log-all-block-events-and-errors: true <defaulted>enable-nvram-write: false <defaulted>enable-acl-logging: false <defaulted>allow-sensor-block: false <defaulted>block-enable: true <defaulted>block-max-entries: 250 <defaulted>max-interfaces: 250 default: 250master-blocking-sensors (min: 0, max: 100, current: 0)----------------------------------------------------------------------------------------------never-block-hosts (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------never-block-networks (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------block-hosts (min: 0, max: 250, current: 0)----------------------------------------------------------------------------------------------block-networks (min: 0, max: 250, current: 0)---------------------------------------------------------------------------------------------------------------------------------------------user-profiles (min: 0, max: 250, current: 11)-----------------------------------------------profile-name: 2adminprofile-name: r7200profile-name: insidePixprofile-name: qatestprofile-name: fwsmprofile-name: outsidePixprofile-name: catprofile-name: rcatprofile-name: nopassprofile-name: testprofile-name: sshswitch-----------------------------------------------cat6k-devices (min: 0, max: 250, current: 1)-----------------------------------------------ip-address: 10.89.147.61-----------------------------------------------router-devices (min: 0, max: 250, current: 1)-----------------------------------------------ip-address: 10.89.147.54-----------------------------------------------firewall-devices (min: 0, max: 250, current: 2)-----------------------------------------------ip-address: 10.89.147.10ip-address: 10.89.147.82-----------------------------------------------sensor(config-net)#Step 4
sensor(config-net)# show settings | include profile-name|ip-addressprofile-name: 2adminprofile-name: r7200profile-name: insidePixprofile-name: qatestprofile-name: fwsmprofile-name: outsidePixprofile-name: catprofile-name: rcatprofile-name: nopassprofile-name: testprofile-name: sshswitchip-address: 10.89.147.61profile-name: catip-address: 10.89.147.54profile-name: r7200ip-address: 10.89.147.10profile-name: insidePixip-address: 10.89.147.82profile-name: testsensor(config-net)#
