Explanation/Reference:
Explanation:
The following actions require the device to be deployed in Inline mode and are in affect for a user-
configurable default time of 3600 seconds (60 minutes).
Deny attacker inline: This action is the most severe and effectively blocks all communication from the
attacking host that passes through the IPS for a specified period of time. Because this event action is
severe, administrators are advised to use this only when the probability of false alarms or spoofing is
minimal.
Deny attacker service pair inline: This action prevents communication between the attacker IP address
and the protected network on the port in which the event was detected. However, the attacker would be
able to communicate on another port that has hosts on the protected network. This event action works well
for worms that attack many hosts on the same service port. If an attack occurred on the same host but on
another port, this communication would be allowed. This event action is appropriate when the likelihood of
a false alarm or spoofing is minimal.
Deny attacker victim pair inline: This action prevents the attacker from communicating with the victim on
any port. However, the attacker could communicate with other hosts, making this action better suited for
exploits that target a specific host. This event action is appropriate when the likelihood of a false alarm or
spoofing is minimal.
Deny connection inline: This action prevents further communication for the specific TCP flow. This action
is appropriate when there is the potential for a false alarm or spoofing and when an administrator wants to
prevent the action but not deny further communication.
Deny packet inline: This action prevents the specific offending packet from reaching its intended
destination. Other communication between the attacker and victim or victim network may still exist. This
action is appropriate when there is the potential for a false alarm or spoofing. Note that for this action, the
default time has no effect.
Modify packet inline: This action enables the IPS device to modify the offending part of the packet.
However, it forwards the modified packet to the destination. This action is appropriate for packet
normalization and other anomalies, such as TCP segmentation and IP fragmentation re-ordering.
Reference: http://www.cisco.com/c/en/us/about/security-center/ips-mitigation.html