Cisco Systems IPS4510K9 manual Table B-20 Service Generic Engine Parameters

Appendix B Signature Engines

Service Engines

Table B-20lists the parameters specific to the Service Generic engine.

Table B-20	Service Generic Engine Parameters
Parameter		Description		Value
specify-dst-port {yes		(Optional) Enables the destination port:		0 to 65535
no}		• dst-port—Specifies the destination port of
		interest for this signature.
specify-ip-protocol		(Optional) Enables IP protocol:		0 to 255
{yes no}		• ip-protocol—Specifies the IP protocol this
		inspector should examine.
specify-payload-source		(Optional) Enables payload source inspection:		icmp-data
{yes no}		• payload-source—Specifies the payload source		l2-header
				l3-header
		inspection for the following types:
				l4-header
		–	Inspects ICMP data
				tcp-data
		– Inspects Layer 2 headers		udp-data
		– Inspects Layer 3 headers
		– Inspects Layer 4 headers
		–	Inspects TCP data
		–	Inspects UDP data
specify-src-port {yes		(Optional) Enables the source port:		0 to 65535
no}		• src-port—Specifies the source port of interest
		for this signature.
specify-regex-string		Specifies the regular expression to look for when the		string
{yes no}		policy type is Regex:		0 to 65535
		• regex-string—Specifies a regular expression to
		search for in a single TCP packet.
		• (Optional) specify-min-match-length—Enables
		minimum match length for use:
		– min-match-length—Specifies the minimum
			length of the Regex match required to
			constitute a match.
swap-attacker-victim		Swaps the attacker and victim addresses and ports		true false (default)
		(source and destination) in the alert message and in
		any actions taken.

For More Information

•For more information on the parameters common to all signature engines, see Master Engine, page B-4.

•For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-43