38-18
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 38 Defining IPS Signatures
Configuring Signatures
•Service H225—Inspects VoIP traffic.
•service-http—Inspects HTTP traffic. The WEBPORTS variable defines inspection port for HTTP
traffic.
•Service IDENT—Inspects IDENT (client and server) traffic.
•Service MSRPC—Inspects MSRPC traffic.
•Service MSSQL—Inspects Microsoft SQL traffic.
•Service NTP—Inspects NTP traffic.
•service-rpc—Inspects RPC traffic.
•Service SMB—Inspects SMB traffic.
•Service SMB Advanced—Processes Microsoft SMB and Microsoft RPC over SMB packets.
•Service SNMP—Inspects SNMP traffic.
•Service SSH—Inspects SSH traffic.
•Service TNS—Inspects TNS traffic.
•state—Stateful searches of strings in protocols such as SMTP.
•string-icmp—Searches on Regex strings based on ICMP protocol.
•string-tcp—Searches on Regex strings based on TCP protocol.
•string-udp—Searches on Regex strings based on UDP protocol.
•Sweep—Analyzes sweeps of ports, hosts, and services, from a single host (ICMP and TCP), from
destination ports (TCP and UDP), and multiple ports with RPC requests between two nodes.
•Sweep Other TCP—Analyzes TCP flag combinations from reconnaissance scans that are trying to
get information about a single host. The signatures look for flags A, B, and C. When all three are
seen, an alert is fired.
•Traffic ICMP—Analyzes nonstandard protocols, such as TFN2K, LOKI, and DDOS. There are only
two signatures with configurable parameters.
•Traffic Anomaly—Analyzes TCP, UDP, and other traffic for worm-infested hosts.
•Trojan Bo2k—Analyzes traffic from the nonstandard protocol BO2K. There are no
user-configurable parameters in this engine.
•Trojan Tfn2k—Analyzes traffic from the nonstandard protocol TFN2K. There are no
user-configurable parameters in this engine.
•Trojan UDP—Analyzes traffic from the UDP protocol. There are no user-configurable parameters
in this engine.
Cloning Signatures
If you want to create a custom signature that is similar to an existing signature, you can create a clone,
or copy, of the signature. You can then edit the parameters to make the clone perform according to your
requirements.
For example, you might want to create a clone of a Cisco-defined signature to customize it to your needs.
You might find this preferable to converting the Cisco signature to a Local or shared policy signature and
directly editing its parameters.
To clone a signature, follow these steps: