B-29
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Atomic Engine
For More Information
For more information on the parameters common to all signature engines, see Master Engine, page B-4.
Atomic IPv6 Engine
The Atomic IPv6 engine detects two IOS vulnerabilities that are stimulated by malformed IPv6 traffic.
These vulnerabilities can lead to router crashes and other security issues. One IOS vulnerability deals
with multiple first fragments, which cause a buffer overflow. The other one deals with malformed
ICMPv6 Neighborhood Discovery options, which also cause a buffer overflow.
Note
IPv6 increases the IP address size from 32 bits to 128 bits, wh ich supports more levels of addressing
hierarchy, a much greater number of addressable nodes, and autoconfiguration of addresses.
Atomic IPv6 Signatures
There are eight Atomic IPv6 signatures. The Atomic IPv6 inspects Neighborhood Discovery protocol of
the following types:
•
Type 133—Router Solicitation
•
Type 134—Router Advertisement
•
Type 135—Neighbor Solicitation
•
Type 136—Neighbor Advertisement
•
Type 137—Redirect
Note
Hosts and routers use Neighborhood Discovery to determine the link-layer addresses f or neighbors
known to reside on attached links and to quickly purge cached values that become invalid. Hosts also use
Neighborhood Discovery to find neighboring routers that will forward packets on their behalf.
specify-udp-valid-length {yes | no} (Optional) Enables inspection of the
Layer 4 UDP valid length:
•
udp-valid-length—Specifies UDP
packet lengths that are considered
valid and should not be inspected.
0 to 65535
specify-udp-length-mismatch {yes |
no}
(Optional) Enables inspection of the
Layer 4 UDP length mismatch:
•
udp-length-mismatch—Fires an
alert when the IP Data length is
less than the UDP Header length.
0 to 65535
1. Use the following syntax: x.x.x.x-z.z.z.z, for example, 10.10.10.1-10.10.10.254.
TableB-9 Atomic IP Engine Parameters (continued)
Parameter Description Value