Cisco Systems IPS4510K9 Example String TCP Engine Signature

7-41
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter7 Defining Signatures
Creating Custom Signatures
Example String TCP Engine Signature
The String engine is a generic-based pattern-matching inspection engine for ICMP, TCP, and UDP
protocols. The String engine uses a regular expression engine that can combine multiple patterns into a
single pattern-matching table allowing for a single search through the data. There are three String
engines: String ICMP, String TCP, and String UDP.
Caution A custom signature can affect the performance of your sensor. Test the custom signature against a
baseline sensor performance for your network to determine the overall impact of the signature.
Note This procedure also applies to String UDP and ICMP signatures.
The following options apply:
• default—Sets the value back to the system default setting.
• direction—Specifies the direction of the traffic:
– from-service—Traffic from service port destined to client port.
– to-service—Traffic from client port destined to service port.
• event-action —Specifies the action(s) to perform when alert is triggered:
– deny-attacker-inline (inline only)—Does not transmit this packet and future packets from the
attacker address for a specified period of time.
– deny-attacker-service-pair-inline (inline only)—Does not transmit this packet and future
packets on the attacker address victim port pair for a specified period of time.
– deny-attacker-victim-pair-inline (inline only)—Does not transmit this packet and future
packets on the attacker/victim address pair for a specified period of time.
– deny-connection-inline (inline only)—Does not transmit this packet and future packets on the
TCP flow.
– deny-packet-inline (inline only)—Does not transmit this packet.
– log-attacker-packets—Starts IP logging of packets containing the attacker address.
– log-pair-packets—Starts IP logging of packets containing the attacker-victim address pair.
– log-victim-packets—Starts IP logging of packets containing the victim address.
– produce-alert —Writes the event to the Event Store as an alert.
– produce-verbose-alert—Includes an encoded dump (possibly truncated) of the offending
packet in the alert.
– request-block-connection—Sends a request to the ARC to block this connection.
– request-block-host—Sends a request to the ARC to block this attacker host.
– request-rate-limit—Sends a rate limit request to the ARC to perform rate limiting.
– request-snmp-trap—Sends a request to the Notification Application component of the sensor
to perform SNMP notification.
– reset-tcp-connection—Sends TCP resets to hijack and terminate the TCP flow.
– modify-packet-inline— Modifies packet data to remove ambi guity about what the end point
might do with the packet.