Symantec 10521146 Administration Guide - Page 150

150 Responding Setting response actions in the custom response dialog. No characters following the %* are interpreted, so a % is acceptable in a password. Escaping the % directive If you need to pass a % as the first character of an argument and do not want it to be interpreted as a replacement directive preface the % with another %. For example %s will be interpreted as a directive to replace this argument with the source address:port list, but %%s will be passed directly as %s and not interpreted. Setting a TCP reset response action The TCP reset response action directs Symantec Network Security to terminate a TCP connection to prevent further damage from an attack. The minimum delay between responses is 0. To enable TCP resets 1 In the Network Security console, click Configuration > Response Rules. 2 In Response Rules, click the Response Action column of a rule. 3 In Configure Response Action, click TCP Reset. 4 Provide the following information: ■ Maximum number of TCP resets: Enter the number of TCP resets per incident of this response. ■ Delay between sending TCP resets (mins): Enter the time in minutes that you want Symantec Network Security to wait per incident, before sending another TCP reset. 5 In Configure Response Action, click OK to save and exit. 6 In Response Rules, click OK to save and exit. Setting traffic record response action The traffic record response dynamically records network traffic in response to an event. With this option, Symantec Network Security can record traffic for a specified period of time, or until a specified number of packets has been collected. The traffic record response action begins recording traffic when triggered. It continues to record based on the number of minutes and the number of packets specified in the response configuration. Traffic recording stops when either limit is reached, whichever comes first. If the maximum number of packets is