A-23
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
SensorApp
Understanding the SensorApp
The SensorApp performs packet capture and analysis. Policy violations are detected through signatures
in the SensorApp and the information about the violations is forwarded to the Event Store in the form of
an alert. Packets flow through a pipeline of processors fed by a producer designed to collect packets from
the network interfaces on the sensor. Event actions can be associated with an event risk rating threshold
that must be surpassed for the actions to take place. Some of the processors call inspectors to perform
signature analysis. All inspectors can call the alarm channel to produce alerts as needed.
The SensorApp supports the following processors:
•
Time Processor—This processor processes events stored in a time-slice calendar. Its primary task is
to make stale database entries expire and to calculate time-dependent statistics.
•
Deny Filters Processor—This processor handles the deny attacker functions. It maintains a list of
denied source IP addresses. Each entry in the list expires based on the global d eny timer, which you
can configure in the virtual sensor configuration.
•
Signature Event Action Processor—This processor processes event actions. Event actions can be
associated with an event risk rating thre shold that must be surpassed for the actions to take place. It
supports the following event actions:
–
Reset TCP flow
–
IP log
–
Deny packets
–
Deny flow
–
Deny attacker
–
Alert
–
Block host
–
Block connection
–
Generate SNMP trap
–
Capture trigger packet
•
Statistics Processor—This processor keeps track of system statistics such as packet counts and
packet arrival rates.
•
Layer 2 Processor—This processor processes layer 2-related events. It also identifies malformed
packets and removes them from the processing path. You can configure actionable events for
detecting malformed packets such as alert, capture packet, and deny packet. The layer 2 processor
updates statistics about packets that have been denied because of the policy you have configured.
•
Database Processor—This processor maintains the signature state and flow databases.
•
Fragment Reassembly Processor—This processor reassembles fragmented IP datagrams. It is also
responsible for normalization of IP fragments when the sensor is in inline mode.
•
Stream Reassembly Processor—This processor reorders TCP streams to ensure the arrival order of
the packets at the various stream-based inspectors. It is also responsible for normalization of the
TCP stream. The normalizer engine lets you enable or disable alert and de ny actions.
The TCP Stream Reassembly Processor normalizer has a hold-d own timer, which lets the stream
state rebuild after a reconfiguration event. You cannot configure the timer. During the hold-down
interval, the system synchronizes stream state on the first packet in a stream that passes through the
system. When the hold down has expired, sensorApp enforces your configured p olicy. If this policy
calls for a denial of streams that have not been opened with a 3-way handshake, estab lished streams