Cisco Systems IPS4510K9 manual Syn

Chapter 7 Defining Signatures

Configuring Signatures

Table 7-6	TCP Stream Reassembly Signatures (continued)
			Parameter With
			Default Value and
Signature ID and Name		Description	Range	Default Actions
1330 7 TCP Drop - Bad WinScale Option		Fires when a TCP packet has a	Modify Packet Inline	Modify Packet Inline
Value		bad window scale value.	sets the value to the
			closest constraint
			value.
1330 8 TCP Drop - SACK Allow Without		Fires when the TCP SACK	Modify Packet Inline	Modify Packet Inline
SYN		allowed option is seen in a	clears the SACK
		packet without the SYN flags	allowed option.
		set.
1330 9 TCP Drop - Data in SYNACK		Fires when TCP packet with	—	Deny Packet Inline
		SYN and ACK flags set also
		contains data.
1330 10 TCP Drop - Data Past FIN		Fires when TCP data is	—	Deny Packet Inline
		sequenced after FIN.
1330 11 TCP Drop - Timestamp not		Fires when TCP packet has	—	Deny Packet Inline
Allowed		timestamp option when
		timestamp option is not
		allowed.
1330 12 TCP Drop - Segment Out of Order		Fires when TCP segment is out	—	Deny Packet Inline
		of order and cannot be queued.
1330 13 TCP Drop - Invalid TCP Packet		Fires when TCP packet has	—	Deny Packet Inline
		invalid header.
1330 14 TCP Drop - RST or SYN in		Fires when TCP packet with	—	Deny Packet Inline
window		RST or SYN flag was sent in
		the sequence window but was
		not the next sequence.
1330 15 TCP Drop - Segment Already		Fires when TCP packet	—	Deny Packet Inline
ACKed		sequence is already ACKed by
		peer (excluding keepalives).
1330 16 TCP Drop - PAWS Failed		Fires when TCP packet fails	—	Deny Packet Inline
		PAWS check.
1330 17 TCP Drop - Segment out of State		Fires when TCP packet is not	—	Deny Packet Inline
Order		proper for the TCP session
		state.
1330 18 TCP Drop - Segment out of		Fires when TCP packet	—	Deny Packet Inline
Window		sequence number is outside of
		allowed window.
3050 Half Open SYN Attack			syn-flood-max-embry
			onic 5000
3250 TCP Hijack			max-old-ack 200
3251 TCP Hijack Simplex Mode			max-old-ack 100

1.The timer is reset to 0 after each packet on the TCP session. by default, this signature does not produce an alert. You can choose to produce alerts for expiring TCP connections if desired. A statistic of total number of expired flows is updated any time a flow expires.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		7-35