Cisco Systems IPS4510K9 manual Atomic IPv6 Engine, Atomic IPv6 Signatures

Appendix B Signature Engines

Atomic Engine

Table B-9	Atomic IP Engine Parameters (continued)
Parameter		Description		Value
specify-udp-valid-length {yes no}		(Optional) Enables inspection of the		0 to 65535
		Layer 4 UDP valid length:
		•	udp-valid-length—Specifies UDP
			packet lengths that are considered
			valid and should not be inspected.
specify-udp-length-mismatch {yes		(Optional) Enables inspection of the		0 to 65535
no}		Layer 4 UDP length mismatch:
		•	udp-length-mismatch—Fires an
			alert when the IP Data length is
			less than the UDP Header length.

1. Use the following syntax: x.x.x.x-z.z.z.z, for example, 10.10.10.1-10.10.10.254.

For More Information

For more information on the parameters common to all signature engines, see Master Engine, page B-4.

Atomic IPv6 Engine

The Atomic IPv6 engine detects two IOS vulnerabilities that are stimulated by malformed IPv6 traffic. These vulnerabilities can lead to router crashes and other security issues. One IOS vulnerability deals with multiple first fragments, which cause a buffer overflow. The other one deals with malformed ICMPv6 Neighborhood Discovery options, which also cause a buffer overflow.

Note IPv6 increases the IP address size from 32 bits to 128 bits, which supports more levels of addressing

hierarchy, a much greater number of addressable nodes, and autoconfiguration of addresses.

Atomic IPv6 Signatures

There are eight Atomic IPv6 signatures. The Atomic IPv6 inspects Neighborhood Discovery protocol of the following types:

•Type 133—Router Solicitation

•Type 134—Router Advertisement

•Type 135—Neighbor Solicitation

•Type 136—Neighbor Advertisement

•Type 137—Redirect

Note Hosts and routers use Neighborhood Discovery to determine the link-layer addresses for neighbors known to reside on attached links and to quickly purge cached values that become invalid. Hosts also use Neighborhood Discovery to find neighboring routers that will forward packets on their behalf.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-29