B-32
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Flood Engine
Tabl e B-12 lists the parameters specific to the Fixed UDP engine.
For More Information
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
•
For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.
Flood Engine
The Flood engines define signatures that watch for any host or network sending multiple packets to a
single host or network. For example, you can create a signature that fires when 150 or more pac kets per
second (of the specific type) are found going to the victim host. There are two Flo od engines: Flood Host
and Flood Net.
TableB-12 Fixed UDP Engine Parameters
Parameter Description Value
direction Specifies the direction of traffic:
•
Traffic from service port destined to
client port.
•
Traffic from client port destined to
service port
from-service
to-service
max-payload-inspect-length Specifies the maximum inspection depth
for the signature.
1 to 250
regex-string Specifies the regular expression to search
for in a single packet.
string
specify-exact-match-offset
{yes | no}
(Optional) Enables exact match offset:
•
exact-match-offset—Specifies the
exact stream offset the regex-string
must report for a match to be valid.
0 to 65535
specify-min-match-length {yes
| no}
(Optional) Enables minimum match length:
•
min-match-length—Specifies the
minimum number of bytes the
regex-string must match.
0 to 65535
exclude-service-ports {yes |
no}
Enables service ports for use:
•
excluded-service-ports—Specifies a
comma-separated list of ports or port
ranges to exclude.
0 to 65535
1
a-b[,c-d]
1. The second number in the range must be greater than or equal to the first number.
swap-attacker-victim Swaps the attacker and victim addresses
and ports (source and destination) in the
alert message and in any actions taken.
false | true (default)