Model:
WS-SVC-ADM-1-K9 Catalyst 6500 Service Module
Detail:
Catalyst 6500 Cisco Anomaly Detection Module
Feature
Description
Attack Recognition
• Spoofed and nonspoofed attacks
• TCP (syns, syn-acks, acks, fins, fragments) attacks
• User Datagram Protocol (UDP) attacks (random port floods, fragments)
• Internet Control Message Protocol (ICMP) attacks (unreachable, echo, fragments)
• Domain Name System (DNS) attacks
• Client attacks
• Inactive and total connections attacks
• HTTP Get Flood attacks
• Border Gateway Protocol (BGP) attacks
• Session Initiation Protocol (SIP) voice over IP (VoIP) attacks
Continuous Learning and Detection
• Can operate in continuous learning and detection mode (Release 5.0 and later)
• Simultaneously adjusts thresholds and detects attacks
• Switches between learning and detection modes automatically
• Returns to learning mode after an attack is completed
Learns for Anomaly Guard Module
• Ability to learn traffic profiles for zones defined on guards
• Ability to upload learning information to guards automatically
Traffic Analysis
• Ability to capture and packets that are traversing the guard and save them as pcap files
• The GUI allows extensive analysis of the captured packets
• The user may limit capture to packets with a certain decision value only (forward, drop, reply)