B-35
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Multi String Engine
For More Information
•
For an example of a custom Meta engine signature, see Example Meta Engine Signature, page 7-46.
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
Multi String Engine
Caution
The Multi String engine can have a significant impact on memory usage.
The Multi String engine lets you define signatures that inspect Layer 4 transport protocol (ICMP, TCP,
and UDP) payloads using multiple string matches for one signat ure. You can specify a series of regular
expression patterns that must be matched to fire the signature. For example, you can define a signa ture
that looks for regex 1 followed by regex 2 on a UDP service. For UDP and TCP you can specify port
numbers and direction. You can specify a single source port, a single destination port, or both ports. The
string matching takes place in both directions.
Use the Multi String engine when you need to specify more than one Regex pattern. Otherwise, you can
use the String ICMP, String TCP, or String UDP engine to specify a single Regex pattern for one of those
protocols.
Tabl e B-16 lists the parameters specific to the Multi String Engine.
meta-key Specifies the storage type for the Meta signature:
•
Attacker address
•
Attacker and victim addresses
•
Attacker and victim addresses and ports
•
Victim address
•
Axxx
•
AxBx
•
AaBb
•
xxBx
unique-victim-ports Specifies the number of unique victims ports
required per Meta signature.
1 to 256
TableB-15 Meta Engine Parameters (continued)
Parameter Description Value
TableB-16 Multi String Engine Parameters
Parameter Description Value
inspect-length Specifies the length of the stream or packet that
must contain all offending strings for the signature
to fire.
0 to 4294967295
protocol Specifies the Layer 4 protocol selection. icmp
tcp
udp