Cisco Systems IPS4510K9 Example String XL TCP Engine Match Offset Signature

7-52
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Creating Custom Signatures
For More Information
• For more information about the Atomic IP Advanced engine and a list of the parameters, see Atomic
IP Advanced Engine, page B-15.
• For more information on the Atomic engines, see Atomic Engine, page B-14.
Example String XL TCP Engine Match Offset Signature
Caution A custom signature can affect the performance of your sensor. Test the custom signature against a
baseline sensor performance for your network to determine the overall impact of the signature.
Note This procedure also applies to String XLUDP and String XL ICMP signatures, with the exception of the
parameter service-ports, which does not apply to String XL ICMP signatures.
The following example demonstrates how to create a custom String XL TCP signature that searches for
exact, maximum, or minimum offsets. You can modify the following optional match offset parameters
for this custom String XL TCP signature:
• specify-exact-match-offset {yes |no}—Enables exact match offset:
– exact-match-offset—Specifies the exact stream offset in bytes the regular expression string
must report for a match to be valid. The value is 0 to 65535.
• specify-max-match-offset {yes |no}—Enables maximum match length:
– max-match-offset—Specifies the maximum stream offset in bytes the regular expression string
must report for a match to be valid. The value is 0 to 65535.
• specify-min-match-offset {yes |no}—Enables minimum match offset:
– min-match-offset—Specifies the minimum stream offset in bytes the regular expression string
must report for a match to be valid. The value is 0 to 65535.
Creating a String XL TCP Engine Signature
To create a custom signature based on the String XL TCP engine that searches for matches, follow these
steps:
Step 1 Log in to the CLI using an account with administrator or operator privileges.
Step 2 Enter signature definition submode.
sensor# configure terminal
sensor(config)# service signature-definition sig1
Step 3 Specify a signature ID and subsignature ID for the signature. Custom signatures are in the range of 60000
to 65000.
sensor(config-sig)# signatures 60003 0
Step 4 Enter signature description submode.
sensor(config-sig-sig)# sig-description