How mcafee IPS treats the duplicate Packets? Does it still scan the duplicate packets or just forward without inspection?
Which packets is considered as duplicate packets? The same (source MAC, Destination MAC), same (source IP, destination IP), same (source port, destination port), same sequence number, etc...
Assume that we have the network like this:
Link between SW01 and R1 is configured as trunk
McAfee IPS sits between SW01 and R1.
We have 3 vlan
Traffic from PC1 to PC2 will first hit IPS, received by R1. R1 does routing and forwards this packet to back. This packet will hit the IPS again with the same data from Layer 3 to Layer 7, but the Layer 2 header is changed. So is this packet considered as duplicate packet?
What's the best practice for this case? Because if the IPS inspect the same traffic twice, the performance is decreased, duplicate alerts will occur.
To prevent the failover pair from forwarding the same alert twice, each node in the pair adheres to the following rules:
The Sensor that received the attack packet on its monitoring port sends the signature alert to the Manager. (The Sensor that gets a copy of the attack packet from its failover peer does not send an alert.)
The Sensor forwarding the alert also takes the configured response action, such as sending a TCP reset.
The Sensor that has been online the longest is responsible for sending all reconnaissance and DoS alerts to the Manager.
In the event that both Sensors have been up for exactly the same amount time, the Sensor with the higher value serial number will be responsible for sending all reconnaissance and DoS alerts.
Was my reply helpful? If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.