Cisco Systems IPS4510K9 Fixed Engine

B-30
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Fixed Engine
Each Neighborhood Discovery type can have one or more Neighborhood Discovery options. The Atomic
IPv6 engine inspects the length of each option for compliance with the legal values stated in RFC 2461.
Violations of the length of an option results in an alert corresponding to the option type w here the
malformed length was encountered (signatures 1601 to 1605).
Note The Atomic IPv6 signatures do not have any specific parameters to configure.
For More Information
For more information on the parameters common to all signature engines, see Master Engine, page B-4.
Fixed Engine
The Fixed engines combine multiple regular expression patterns in to a single pattern matching table that
allows a single search through the data. It supports ICMP, TCP, and UDP protocols. After a minimum
inspection depth is reached (1 to 100 bytes), inspection stops. There are three Fixed engines: Fixed
ICMP, Fixed TCP, and Fixed UDP.
Note The Fixed TCP and Fixed UDP engines use the service-ports parameter as exclusion ports. The Fixed
ICMP engine uses the service-ports parameter as excluded IC MP types.
Tabl e B-10 lists the parameters specific to the Fixed ICMP engine.
TableB-10 Fixed ICMP Engine Parameters
Parameter Description Value
direction Specifies the direction of traffic:
• Traffic from service port destined to
client port.
• Traffic from client port destined to
service port.
from-service
to-service
max-payload-inspect-length Specifies the maximum inspection depth
for the signature.
1 to 250
regex-string Specifies the regular expression to search
for in a single packet.
string
specify-exact-match-offset
{yes | no}
(Optional) Enables exact match offset:
• exact-match-offset—Specifies the
exact stream offset the regex-string
must report for a match to be valid.
0 to 65535
specify-min-match-length {yes
| no}
(Optional) Enables minimum match length:
• min-match-length—Specifies the
minimum number of bytes the
regex-string must match.
0 to 65535