B-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Master Engine
Note
The Regex accelerator card is used for both the standard String engines and the String XL
engines. Most standard String engine signatures can be compiled and analyzed by the Regex
accelerator card without modification. However, there are special circumstances in which
the standard String engine signatures cannot be compiled for the Regex accelerator card. In
these situations a new signature is written in a String XL engine using the specific
parameters in the String XL engine that do compile on the Regex accelerator card. The new
signature in the String XL engine obsoletes the original signature in the standard String
engine.
•
Sweep—Analyzes sweeps from a single host (ICMP and TCP), from destination ports (TCP and
UDP), and multiple ports with RPC requests between two nodes. There are two Sweep engines:
Sweep and Sweep Other TCP.
•
Traffic Anomaly—Inspects TCP, UDP, and other traffic for worms.
•
Traffic ICMP—Analyzes nonstandard protocols, such as TFN2K, LOKI, and DDOS. There are only
two signatures with configurable parameters.
•
Trojan—Analyzes traffic from nonstandard protocols, such as BO2K andTFN2K. There are three
Trojan engines: Bo2k, Tfn2k, and UDP. There are no user-configurable parameters in these engines.
For More Information
For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.
Master Engine
The Master engine provides structures and methods to the other engines and handles input from
configuration and alert output. This section describes the Master engine, and contains the following
topics:
•
General Parameters, page B-4
•
Alert Frequency, page B-7
•
Event Actions, page B-8

General Parameters

The following parameters are part of the Master engi ne and apply to all signatures (if it makes sense for
that signature engine). Tabl e B-1 lists the general master engine parameters.
TableB-1 Master Engine Parameters
Parameter Description Value
signature-id Specifies the ID of this signature. number
sub-signature-id Specifies the sub ID of this signature number