Change the intrusion detection policy file

Learn the steps for changing your intrusion detection policy file.

1. Stop the QoS server using the following command: endtcpsvr *qos
2. Edit the IDS policy file in the /QIBM/UserData/OS400/QOS/ETC/ directory.
3. Start the QoS server using the following command: strtcpsvr *qos
4. Issue the Work with Active Jobs (WRKACTJOB) command to verify that the QoS server has started. You will see QTOQSRVR in the list of started servers.

• Example: Traffic regulation policy
  This sample traffic regulation policy traces suspicious traffic across the network, such as an unusually high rate of TCP connections.
• Example: Restricted IP protocol policy
  This example is of an IDS attack-type policy that targets restricted IP protocols in the range of 200 to 205.
• Example: Perpetual echo policy
  This example is of an IDS attack-type policy that targets perpetual echoes on local port 7 and remote port 7.
• Example: Intrusion detection scan policy
  This example is of a scan policy that uses stand-alone conditions and actions.
• Keywords in the IDS policy file
  Most of the keywords in the IDS policy file are supported in this release, but a few of them are not supported.