Configures the IPS detection thresholds for reconnaissance activity on an IPS-enabled appliance.
This command is available only when IPS detection of reconnaissance activity are enabled. However, IPS detection of brute-force attacks is enabled by default.
On an appliance enabled for IPS detection of reconnaissance activity, configures the IPS detection thresholds for triggering ping sweep events and port scan events. For more information, see the Network Security IPS Feature Guide.
Note
You can also run this command remotely from the command line of an integrated Central Management System appliance using the central management appliance proxying mechanism.
Syntax
ips reconnaissance threshold ( ping‑sweep <value> | port‑scan <value> )
Parameters
ping‑sweep <value>
The appliance triggers an IPS ping sweep event when the number of ICMP exchanges to or from the same IP address within a rolling 60-second window exceeds this value. The valid range is 10 through 1000. The default value is 20.
port‑scan <value>
The appliance triggers an IPS port scan event when the number of TCP or UDP exchanges to or from the same IP address within a rolling 60-second window exceeds this value. The valid range is 10 through 1000. The default value is 200.
Examples
ips reconnaissance ping-sweep
hostname (config) # ips reconnaissance ping-sweep 20
ips reconnaissance port-scan
hostname (config) # ips reconnaissance port-scan 200
User role
Operator or Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 7.5.0