B-40
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Service Engines
•
Service NTP Engine, pageB-52
•
Service P2P Engine, pageB-53
•
Service RPC Engine, page B-53
•
Service SMB Advanced Engine, page B-55
•
Service SNMP Engine, page B-57
•
Service SSH Engine, page B-58
•
Service TNS Engine, pageB-59
Understanding the Service Engines
The Service engines analyze Layer 5+ traffic between two hosts. These are one-to-one signatures that
track persistent data. The engines analyze the Layer5+ payload in a manner similar to the live service.
The Service engines have common characteristics but each engine has specific knowledge of the service
that it is inspecting. The Service engines supplement the capabilities of the generic string engine
specializing in algorithms where using the string engine is inadequate or undesirable.
Service DNS Engine
The Service DNS engine specializes in advanced DNS decode, which includes anti-evasive techniques,
such as following multiple jumps. It has many parameters, such as lengths, opcodes, strings, and so forth.
The Service DNS engine is a biprotocol inspector operating on both TCP and UDP port 53. It uses the
stream for TCP and the quad for UDP.
Tabl e B-18 lists the parameters specific to the Service DNS engine.
TableB-18 Service DNS Engine Parameters
Parameter Description Value
protocol Specifies the protocol of interest for this
inspector.
tcp
udp
specify-query-chaos-string {yes |no} (Optional) Enables the DNS Query Class
Chaos String:
•
query-chaos-string—Specifies the
query chaos string to search on.
query-chaos-string
specify-query-class {yes |no} (Optional) Enables the query class:
•
query-class—Specifies the DNS
Query Class 2 Byte Value.
0 to 65535
specify-query-invalid-domain-name
{yes |no}
(Optional) Enables the query invalid
domain name:
•
query-invalid-domain-name—Specifie
s the DNS Query Length greater
than 255.
no | yes