Cisco Systems IPS4510K9 manual Service Ident Engine

Appendix B Signature Engines

Service Engines

Table B-22	Service HTTP Engine Parameters (continued)
Parameter		Description	Value
specify-request-regex {yes no}		(Optional) Enables searching the Request	0 to 65535
		field for a specific regular expression:
		• request-regex—Specifies the regular
		expression to search in both HTTP URI
		and HTTP Argument fields.
		• specify-min-request-match-length—Enabl
		es setting a minimum request match
		length:
		– min-request-match-length—Specifies
		the minimum request match length.
specify-uri-regex {yes no}		(Optional) Specifies the regular expression	[/\\][a-zA-Z][a-zA-
		to search in HTTP URI field.	Z][a-zA-Z][a-zA-Z]
		Note The URI field is defined to be after	[a-zA-Z][a-zA-Z][a
			-zA-Z][.]jpeg
		the HTTP method (GET, for
		example) and before the first CRLF.
		Note The regular expression is protected,
		which means you cannot change the
		value.
service-ports		Specifies a comma-separated list of ports or	0 to 655351
		port ranges where the target service resides.	a-b[,c-d]
swap-attacker-victim		Swaps the attacker and victim addresses and	true false (default)
		ports (source and destination) in the alert
		message and in any actions taken.

1. The second number in the range must be greater than or equal to the first number.

For More Information

•For an example Service HTTP custom signature, see Example Service HTTP Engine Signature, page 7-44.

•For more information on the parameters common to all signature engines, see Master Engine, page B-4.

•For a list of the signature regular expression syntax, see Regular Expression Syntax, page B-9.

Service IDENT Engine

The Service IDENT engine inspects TCP port 113 traffic. It has basic decode and provides parameters to specify length overflows. For example, when a user or program at computer A makes an IDENT request of computer B, it may only ask for the identity of users of connections between A and B. The IDENT server on B listens for connections on TCP port 113. The client at A establishes a connection, then specifies which connection it wants identification for by sending the numbers of the ports on A and B that the connection is using. The server at B determines what user is using that connection, and replies to A with a string that names that user. The Service IDENT engine inspects the TCP port 113 for IDENT abuse.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
B-48	OL-29168-01