Chapter 7 Defining Signatures

Configuring Signatures

Table 7-5

IP Fragment Reassembly Signatures (continued)

 

 

 

 

 

 

 

 

 

 

Parameter With Default Value

 

Signature ID and Name

Description

and Range

Default Action

 

 

 

 

1204 IP Fragment Missing

Fires when the datagram is

—

Deny Packet Inline

Initial Fragment

 

incomplete and missing the initial

 

Produce Alert6

 

 

fragment.

 

 

 

 

 

 

1205 IP Fragment Too

Fires when the total number of partial

Specify Max Partial Datagrams

Deny Packet Inline

Many Datagrams

datagrams in the system exceeds the

1000 (0-10000)

Produce Alert7

 

 

threshold set by Max Partial

 

 

 

 

Datagrams.

 

 

 

 

 

 

1206 IP Fragment Too

Fires when there are more than Max

Specify Max Small Frags 2

Deny Packet Inline

Small

 

Small Frags of a size less than Min

(8-1500)

Produce Alert9

 

 

Fragment Size in one datagram.8

Specify Min Fragment Size 400

 

 

 

 

(1-8)

 

 

 

 

 

1207 IP Fragment Too

Fires when there are more than Max

Specify Max Fragments per

Deny Packet Inline

Many Fragments in a

Fragments per Datagram in one

Datagram 170 (0-8192)

Produce Alert6

Datagram

 

datagram.

 

 

 

 

 

 

1208 IP Fragment

Fires when all of the fragments for a

Specify Fragment Reassembly

Deny Packet Inline

Incomplete Datagram

datagram have not arrived during the

Timeout 60 (0-360)

Produce Alert6

 

 

Fragment Reassembly Timeout.10

 

 

1225 Fragment Flags

Fires when a bad combination of

—11

—

Invalid

 

fragment flags is detected.

 

 

 

 

 

 

 

1.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packets and all associated fragments for this datagram. If you disable this signature, the default values are still used and packets are dropped (inline mode) or not analyzed (promiscuous mode) and no alert is sent.

2.This signature does not fire when the datagram is an exact duplicate. Exact duplicates are dropped in inline mode regardless of the settings. Modify Packet Inline removes the overlapped data from all but one fragment so there is no ambiguity about how the endpoint treats the datagram. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

3.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram. Regardless of the actions set the datagram is not processed by the IPS if the datagram is larger than the Max Datagram size.

4.This is a very unusual event.

5.Modify Packet Inline removes the overlapped data from all but one fragment so there is no ambiguity about how the endpoint treats the datagram. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packets and all associated fragments for this datagram.

6.IPS does not inspect a datagram missing the first fragments regardless of the settings. Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

7.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

8.IPS does not inspect the datagram if this signature is on and the number of small fragments is exceeded.

9.Modify Packet Inline and Deny Connection Inline have no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

10.The timer starts when the packet for the datagram arrives.

11.Modify Packet Inline modifies the flags to a valid combination. Deny Connection Inline has no effect on this signature. Deny Packet Inline drops the packet and all associated fragments for this datagram.

For More Information

For more information about the Normalizer engine, see Normalizer Engine, page B-36.

 

 

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

 

 

 

 

 

 

OL-29168-01

 

 

7-29

 

 

 

 

 

Page 212 Page 214
Page 213
Image 213
Cisco Systems IPS4510K9 manual For More Information
Page 212 Page 214

IPS4510K9 specifications

Cisco Systems has long been a leading player in network security, and its IPS (Intrusion Prevention System) series is a testament to its commitment to safeguarding digital environments. Among its notable offerings are the IPS4510K9 and IPS4520K9 models, both designed to provide advanced threat protection for mid-sized to large enterprise networks.

The Cisco IPS4510K9 and IPS4520K9 are distinguished by their cutting-edge features that help organizations defend against a myriad of cyber threats. These systems utilize a multi-layered approach to security, integrating intrusion prevention, advanced malware protection, and comprehensive visibility across the network.

One of the primary characteristics of the IPS4510K9 is its high performance. It boasts a throughput of up to 1 Gbps, making it suitable for environments that demand rapid data processing and real-time responses to threats. The IPS4520K9, on the other hand, enhances that capability with improved throughput of up to 2 Gbps, accommodating larger enterprises with heavier network traffic. These models are equipped with powerful processors that support complex signature matching and can intelligently distinguish between legitimate traffic and potential threats.

In addition to performance, both models are designed with scalability in mind. They can be easily integrated into existing Cisco infrastructures. This facilitates a seamless enhancement of security without causing significant interruptions to ongoing operations. Moreover, they offer flexible deployment options, allowing organizations to operate them inline or out of band depending on their specific needs.

The Cisco IPS4510K9 and IPS4520K9 leverage advanced detection technologies, utilizing a variety of signature types and heuristic analysis to detect known and unknown threats effectively. They are equipped with real-time alerting and reporting capabilities, giving security teams immediate visibility into potential breaches and enabling them to respond swiftly.

Furthermore, both models support a range of management options through the Cisco Security Manager, allowing for centralized administration, streamlined policy management, and enhanced monitoring capabilities. Automated updates ensure the systems remain current with the latest threat intelligence, vital for staying ahead of evolving cyber threats.

In summary, the Cisco Systems IPS4510K9 and IPS4520K9 represent powerful solutions for organizations seeking robust intrusion prevention capabilities. With their high performance, scalability, and advanced detection technologies, these systems are essential tools in the ever-changing landscape of cybersecurity, providing enterprises with the peace of mind needed to operate securely in today's digital world.
Top Page Image Contents