[Full-Disclosure] IDS WIth TCP Reset and SPAN

["Dain Deutschman" <daind@xxxxxxxxx>]

Hello Group,

Hopefully, this topic is ok to discuss here. I am fairly new to IDS systems and 
am having trouble getting my cisco IDS to send TCP resets. The lab network is 
as follows:


               R4
R1----IDS----|
               R2------R3

R4 and R2 are on the same ethernet segment. R1 is on Command and Control side 
of the sensor. The attack is coming from R3 ( telnet to R4 and issue 
"testattack" string ). The alarm shows up in event viewer...but no tcp 
reset...I mean...my telnet session stays active. 

I know this probably has something to do with how I am setting up SPAN on the 
switch....but I am not sure. The IDS Sensing interface, R4 and R2 are on the 
same switch and in VLAN 20. R3 is in VLAN 30.

I have tried it without span ( just R4, R2 and IDS sensing interfaces in same 
vlan ) and with span configured as follows. Niether has worked.

monitor session 1 source vlan 20 rx
monitor session 1 destination int f0/17 ingress vlan 20

Any ideas??

Thanks,

Dain