B-25
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Atomic Engine
For More Information
•
For an example custom IPv6 signature, see Example IPv6 Engine Sign ature, page 7-50.
•
For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
Atomic IP Engine
The Atomic IP engine defines signatures that inspect IP protocol headers and associated Layer4
transport protocols (TCP, UDP, and ICMP) and payloads. The Atomic engines do not store persistent
data across packets. Instead they can fire an alert from the an alysis of a single packet.
Tabl e B-9 lists the parameters that are specific to the Atomic IP engine.
specify-udp-valid-length {yes |
no}
(Optional) Enables inspection of the
Layer 4 UDP valid length:
•
udp-valid-length—Specifies the UDP
packet lengths that are considered
valid and should not be inspected.
0 to 65535
specify-udp-length-mismatch
{yes | no}
(Optional) Enables inspection of the
Layer 4 UDP length mismatch:
•
udp-length-mismatch—Fires an alert
when IP Data length is less than the
UDP Header length.
0 to 65535
1. When a packet is GRE, IPIP, IPv4inIPv6, or MPL the sensor skips the Layer3 encapsulation header and the encapsulation
header, and all inspection is done starting from the second Layer3. The encapsulation enumerator allows the engine to look
backward to see if there is an encapsulation header before the Layer3 in question.
2. Use the following syntax: x.x.x.x-z.z.z.z, for example, 10.10.10.1-10.10.10.254.
TableB-8 Atomic IP Advanced Engine Parameters (continued)
Parameter Description Value
TableB-9 Atomic IP Engine Parameters
Parameter Description Value
specify-ip-addr-options {yes | no} (Optional) Enables IP address options:
•
ip-addr-options—Specifies the IP
address options.
address-with-localhost
ip-addr
1
rfc-1918-address
src-ip-eq-dst-ip
specify-ip-header-length {yes | no} ( Optional) Enables inspection of the IP
header length:
•
ip-header-length—Specifies t he
length of the IP header to inspect.
0 to 16