Cisco Systems IPS4510K9 manual For More Information

Chapter 7 Defining Signatures

Configuring Signatures

Table 7-5	IP Fragment Reassembly Signatures (continued)
			Parameter With Default Value
Signature ID and Name		Description	and Range	Default Action
1204 IP Fragment Missing		Fires when the datagram is	—	Deny Packet Inline
Initial Fragment		incomplete and missing the initial		Produce Alert6
		fragment.
1205 IP Fragment Too		Fires when the total number of partial	Specify Max Partial Datagrams	Deny Packet Inline
Many Datagrams		datagrams in the system exceeds the	1000 (0-10000)	Produce Alert7
		threshold set by Max Partial
		Datagrams.
1206 IP Fragment Too		Fires when there are more than Max	Specify Max Small Frags 2	Deny Packet Inline
Small		Small Frags of a size less than Min	(8-1500)	Produce Alert9
		Fragment Size in one datagram.8	Specify Min Fragment Size 400
			(1-8)
1207 IP Fragment Too		Fires when there are more than Max	Specify Max Fragments per	Deny Packet Inline
Many Fragments in a		Fragments per Datagram in one	Datagram 170 (0-8192)	Produce Alert6
Datagram		datagram.
1208 IP Fragment		Fires when all of the fragments for a	Specify Fragment Reassembly	Deny Packet Inline
Incomplete Datagram		datagram have not arrived during the	Timeout 60 (0-360)	Produce Alert6
		Fragment Reassembly Timeout.10
1225 Fragment Flags		Fires when a bad combination of	—11	—
Invalid		fragment flags is detected.

1.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packets and all associated fragments for this datagram. If you disable this signature, the default values are still used and packets are dropped (inline mode) or not analyzed (promiscuous mode) and no alert is sent.

2.This signature does not fire when the datagram is an exact duplicate. Exact duplicates are dropped in inline mode regardless of the settings. Modify Packet Inline removes the overlapped data from all but one fragment so there is no ambiguity about how the endpoint treats the datagram. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

3.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram. Regardless of the actions set the datagram is not processed by the IPS if the datagram is larger than the Max Datagram size.

4.This is a very unusual event.

5.Modify Packet Inline removes the overlapped data from all but one fragment so there is no ambiguity about how the endpoint treats the datagram. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packets and all associated fragments for this datagram.

6.IPS does not inspect a datagram missing the first fragments regardless of the settings. Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

7.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

8.IPS does not inspect the datagram if this signature is on and the number of small fragments is exceeded.

9.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

10.The timer starts when the packet for the datagram arrives.

11.Modify Packet Inline modifies the flags to a valid combination. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

For More Information

For more information about the Normalizer engine, see Normalizer Engine, page B-36.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		7-29