Cisco Systems IPS4510K9 manual Parameter Description, Alarm-on-non-http-traffic

Appendix B Signature Engines

AIC Engine

•FTP traffic:

–FTP command authorization and enforcement

Table B-5lists the parameters that are specific to the AIC HTTP engine.

Table B-5	AIC HTTP Engine Parameters
Parameter		Description
signature-type		Specifies the type of AIC signature.		•	content-types
				•	define-web-traffic-policy
				•	max-outstanding-requests-overrun
				•	max-outstanding-requests-overrun
				•	msg-body-pattern
				•	request-methods
				•	transfer-encodings
content-types		Specifies the AIC signature that		—
		deals with MIME types:
		• define-content-type—Associates
			actions such as denying a
			specific MIME type
			(image/gif), defining a
			message-size violation, and
			determining that the
			MIME-type mentioned in the
			header and body do not match.
		• define-recognized-content-types
			—Lists the content types
			recognized by the sensor.
define-web-traffic-policy		Specifies the action to take when		—
		noncompliant HTTP traffic is seen.
		The alarm-on-non-http-traffic
		{true false} command enables the
		signature. This signature is disabled
		by default.
max-outstanding-requests		Specifies the maximum allowed		1 - 16
-overrun		HTTP requests per connection.
msg-body-pattern		Uses Regex to define signatures		—
		that look for specific patterns in the
		message body:
		•	regex-list—
		•	regex-list-in-order—

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
B-12	OL-29168-01