Chapter 7 Defining Signatures

Configuring Signatures

sensor from creating alerts where a valid TCP session has not been established. There are known attacks against sensors that try to get the sensor to generate alerts by simply replaying pieces of an attack. The TCP session reassembly feature helps to mitigate these types of attacks against the sensor.

You configure TCP stream reassembly parameters per signature. You can configure the mode for TCP stream reassembly.

TCP Stream Reassembly Signatures and Configurable Parameters

Table 7-6lists TCP stream reassembly signatures with the parameters that you can configure for TCP stream reassembly. TCP stream reassembly signatures are part of the Normalizer engine.

Table 7-6

TCP Stream Reassembly Signatures

 

 

 

 

 

 

 

 

 

 

Parameter With

 

 

 

 

Default Value and

 

Signature ID and Name

Description

Range

Default Actions

 

 

 

 

1301 TCP Session Inactivity Timeout1

Fires when a TCP session has

TCP Idle Timeout

—2

 

 

been idle for a TCP Idle

3600 (15-3600)

 

 

 

Timeout.

 

 

 

 

 

 

1302 TCP Session Embryonic Timeout3

Fires when a TCP session has

TCP Embryonic

—4

 

 

not completes the three-way

Timeout 15

 

 

 

handshake in TCP embryonic

(3-300)

 

 

 

timeout seconds.

 

 

 

 

 

 

1303 TCP Session Closing Timeout5

Fires when a TCP session has

TCP Closed Timeout

—6

 

 

not closed completely in TCP

5 (1-60)

 

 

 

Closed Timeout seconds after

 

 

 

 

the first FIN.

 

 

 

 

 

 

1304 TCP Session Packet Queue Overflow

This signature allows for

TCP Max Queue 32

—7

 

 

setting the internal TCP Max

(0-128)

 

 

 

Queue size value for the

TCP Idle Timeout

 

 

 

Normalizer engine. As a result

3600

 

 

 

it does not function in

 

 

 

 

promiscuous mode. By default

 

 

 

 

this signature does not fire an

 

 

 

 

alert. If a custom alert event is

 

 

 

 

associated with this signature

 

 

 

 

and if the queue size is

 

 

 

 

exceeded, an alert fires.

 

 

 

 

Note The IPS signature team

 

 

 

 

discourages modifying

 

 

 

 

this value.

 

 

 

 

 

 

1305 TCP Urg Flag Set8

Fires when the TCP urgent flag

TCP Idle Timeout

Modify Packet Inline9

 

 

is seen

3600

 

 

 

 

 

 

 

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

7-32

OL-29168-01

Page 215 Page 217
Page 216
Image 216
Cisco Systems IPS4510K9 manual TCP Stream Reassembly Signatures and Configurable Parameters
Page 215 Page 217

IPS4510K9 specifications

Cisco Systems has long been a leading player in network security, and its IPS (Intrusion Prevention System) series is a testament to its commitment to safeguarding digital environments. Among its notable offerings are the IPS4510K9 and IPS4520K9 models, both designed to provide advanced threat protection for mid-sized to large enterprise networks.

The Cisco IPS4510K9 and IPS4520K9 are distinguished by their cutting-edge features that help organizations defend against a myriad of cyber threats. These systems utilize a multi-layered approach to security, integrating intrusion prevention, advanced malware protection, and comprehensive visibility across the network.

One of the primary characteristics of the IPS4510K9 is its high performance. It boasts a throughput of up to 1 Gbps, making it suitable for environments that demand rapid data processing and real-time responses to threats. The IPS4520K9, on the other hand, enhances that capability with improved throughput of up to 2 Gbps, accommodating larger enterprises with heavier network traffic. These models are equipped with powerful processors that support complex signature matching and can intelligently distinguish between legitimate traffic and potential threats.

In addition to performance, both models are designed with scalability in mind. They can be easily integrated into existing Cisco infrastructures. This facilitates a seamless enhancement of security without causing significant interruptions to ongoing operations. Moreover, they offer flexible deployment options, allowing organizations to operate them inline or out of band depending on their specific needs.

The Cisco IPS4510K9 and IPS4520K9 leverage advanced detection technologies, utilizing a variety of signature types and heuristic analysis to detect known and unknown threats effectively. They are equipped with real-time alerting and reporting capabilities, giving security teams immediate visibility into potential breaches and enabling them to respond swiftly.

Furthermore, both models support a range of management options through the Cisco Security Manager, allowing for centralized administration, streamlined policy management, and enhanced monitoring capabilities. Automated updates ensure the systems remain current with the latest threat intelligence, vital for staying ahead of evolving cyber threats.

In summary, the Cisco Systems IPS4510K9 and IPS4520K9 represent powerful solutions for organizations seeking robust intrusion prevention capabilities. With their high performance, scalability, and advanced detection technologies, these systems are essential tools in the ever-changing landscape of cybersecurity, providing enterprises with the peace of mind needed to operate securely in today's digital world.
Top Page Image Contents