B-9
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Regular Expression Syntax
•
deny-attacker-inline (inline mode only)—Does not transmit this packet and future packets from the
attacker address for a specified period of time.
Note
This is the most severe of the deny actions. It denies the current and future packets from a
single attacker address. Each deny address times out for X seconds from the first event that
caused the deny to start, where X is the amount of seconds that you configured. You can clear
all denied attacker entries with the clear denied-attackers command, which permits the
addresses back on the network.
•
modify-packet-inline (inline mode only)—Modifies packet data to remove ambiguity about what the
end point might do with the packet.
Note
The event action modify-packet-inline is part of the Normalizer engine. It scrubs the packet
and corrects irregular issues such as bad checksum, out of range values, and other RFC
violations.
Other Actions
Note
IPv6 does not support the following event actions: request-block-host,
request-block-connection, or request-rate-limit.
•
request-block-connection—Requests the ARC to block this connection.
•
request-block-host—Requests the ARC to block this attacker host.
•
request-rate-limit—Requests the ARC to perform rate limiting.
•
reset-tcp-connection—Sends TCP resets to hijack and terminate the TCP flow.
Regular Expression Syntax
Regular expressions (Regex) are a powerful and flexible notational language that allow you to describe
text. In the context of pattern matching, regular expressions allow a succinct description of any arbitrary
pattern.
Tabl e B-3 lists the IPS signature Regex syntax.
TableB-3 Signature Regular Expression Syntax
Metacharacter Name Description
? Question mark Repeat 0 or 1 times.
* Star, asterisk Repeat 0 or more times.
+ Plus Repeat 1 or more times.
{x} Quantifier Repeat exactly X times.
{x,} Minimum quantifier Repeat at least X times.
. Dot Any one char acter except new line (0x0A).
[abc] Character class Any character listed.