B-46
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Service Engines
For More Information
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
•
For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.
Service HTTP Engine
The Service HTTP engine is a service-specific string-based pattern-matching inspection engine. The
HTTP protocol is one of the most commonly used in networks of today. In addition, it requires the most
amount of preprocessing time and has the most numbe r of signatures requiring inspection making it
critical to the overall performance of the system.
The Service HTTP engine uses a Regex library that can combine multiple patterns into a single
pattern-matching table allowing a single search through the data. This engine searches traffic directed
only to web services, or HTTP requests. You cannot inspect return traffic with this engine. You can
specify separate web ports of interest in each signature in this engine.
HTTP deobfuscation is the process of decoding an HTTP message by normalizing encode d characters
to ASCII equivalent characters. It is also known as ASCII no rmalization.
specify-regex-string {yes |
no}
Specifies the regular expression to look for when
the policy type is Regex:
•
regex-string—Specifies a regular expression
to search for in a single TCP packet.
•
(Optional)
specify-min-match-length—Enables
minimum match length for use:
–
min-match-length—Specifies the
minimum length of the Regex match
required to constitute a match.
Note
This is never set for TPKT signatures.
string
0 to 65535
specify-value-range {yes |
no}
Enables value range for use:
•
value-range—Specifies the range of values.
Note
Valid for the length or value policy types
(0x00 to 6535). Not valid for other policy
types.
0 to 65535
1
a-b
swap-attacker-victim Swaps the attacker and victim addresses and ports
(source and destination) in the alert message and
in any actions taken.
true | false (default)
1. The second number in the range must be greater than or equal to the first number.
TableB-21 Service H.225 Engine Parameters (continued)
Parameter Description Value