B-49
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Service Engines
Tabl e B-23 lists the parameters specific to the Service IDENT engine.
For More Information
For more information on the parameters common to all signature engines, see Master Engine, page B-4.
Service MSRPC Engine
The Service MSRPC engine processes MSRPC packets. MSRPC allows for cooperative processing
between multiple computers and their application software in a networked environment. It is a
transaction-based protocol, implying that there is a sequence of communications that establishes the
channel and passes processing requests and replies.
MSRPC is an ISO Layer5-6 protocol and is layered on top of other transport protocols such as UDP,
TCP, and SMB. The MSRPC engine contains facilities to allow for fragmentation and reassembly of the
MSRPC PDUs.
This communication channel is the source of recent Windows NT, Windows 2000, and Window XP
security vulnerabilities. The Service MSRPC engine only decodes the DCE and RPC protocol for the
most common transaction types.
TableB-23 Service IDENT Engine Parameters
Parameter Description Value
inspection-type Specifies the type of inspection to perform. has-newline
has-bad-port
size
has-newline Inspects payload for a nonterminating new line character. —
has-bad-port Inspects payload for a bad port. —
size Inspects for payload length longer than this:
•
max-bytes—Specifies the maximum bytes for the payload
length.
0 to 65535
service-ports Specifies a comma-separated list of ports or port ranges where
the target service resides.
0 to 65535
1
a-b[,c-d]
1. The second number in the range must be greater than or equal to the first number.
direction Specifies the direction of the traffic:
•
Traffic from service port destined to client port.
•
Traffic from client port destined to service port.
from-service
to-service