Cisco Systems IPS4510K9 manual Service Msrpc Engine

Appendix B Signature Engines

Service Engines

Table B-23lists the parameters specific to the Service IDENT engine.

Table B-23	Service IDENT Engine Parameters
Parameter		Description	Value
inspection-type		Specifies the type of inspection to perform.	has-newline
			has-bad-port
			size
has-newline		Inspects payload for a nonterminating new line character.	—
has-bad-port		Inspects payload for a bad port.	—
size		Inspects for payload length longer than this:	0 to 65535
		• max-bytes—Specifies the maximum bytes for the payload
		length.
service-ports		Specifies a comma-separated list of ports or port ranges where	0 to 655351
		the target service resides.	a-b[,c-d]
direction		Specifies the direction of the traffic:	from-service
		• Traffic from service port destined to client port.	to-service
		• Traffic from client port destined to service port.

1. The second number in the range must be greater than or equal to the first number.

For More Information

For more information on the parameters common to all signature engines, see Master Engine, page B-4.

Service MSRPC Engine

The Service MSRPC engine processes MSRPC packets. MSRPC allows for cooperative processing between multiple computers and their application software in a networked environment. It is a transaction-based protocol, implying that there is a sequence of communications that establishes the channel and passes processing requests and replies.

MSRPC is an ISO Layer 5-6 protocol and is layered on top of other transport protocols such as UDP, TCP, and SMB. The MSRPC engine contains facilities to allow for fragmentation and reassembly of the MSRPC PDUs.

This communication channel is the source of recent Windows NT, Windows 2000, and Window XP security vulnerabilities. The Service MSRPC engine only decodes the DCE and RPC protocol for the most common transaction types.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-49