Cisco Systems IPS4510K9 manual Atomic IP Engine, For More Information

Appendix B Signature Engines

Atomic Engine

Table B-8	Atomic IP Advanced Engine Parameters (continued)
Parameter		Description	Value
specify-udp-valid-length {yes		(Optional) Enables inspection of the	0 to 65535
no}		Layer 4 UDP valid length:
		• udp-valid-length—Specifies the UDP
		packet lengths that are considered
		valid and should not be inspected.
specify-udp-length-mismatch		(Optional) Enables inspection of the	0 to 65535
{yes no}		Layer 4 UDP length mismatch:
		• udp-length-mismatch—Fires an alert
		when IP Data length is less than the
		UDP Header length.

1.When a packet is GRE, IPIP, IPv4inIPv6, or MPL the sensor skips the Layer 3 encapsulation header and the encapsulation header, and all inspection is done starting from the second Layer 3. The encapsulation enumerator allows the engine to look backward to see if there is an encapsulation header before the Layer 3 in question.

2.Use the following syntax: x.x.x.x-z.z.z.z, for example, 10.10.10.1-10.10.10.254.

For More Information

•For an example custom IPv6 signature, see Example IPv6 Engine Signature, page 7-50.

•For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.

•For more information on the parameters common to all signature engines, see Master Engine, page B-4.

Atomic IP Engine

The Atomic IP engine defines signatures that inspect IP protocol headers and associated Layer 4 transport protocols (TCP, UDP, and ICMP) and payloads. The Atomic engines do not store persistent data across packets. Instead they can fire an alert from the analysis of a single packet.

Table B-9lists the parameters that are specific to the Atomic IP engine.

Table B-9	Atomic IP Engine Parameters
Parameter		Description		Value
specify-ip-addr-options {yes no}		(Optional) Enables IP address options:		address-with-localhost
		•	ip-addr-options—Specifies the IP	ip-addr1
			address options.	rfc-1918-address
				src-ip-eq-dst-ip
specify-ip-header-length {yes no}		(Optional) Enables inspection of the IP		0 to 16
		header length:
		•	ip-header-length—Specifies the
			length of the IP header to inspect.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-25