Cisco Systems IPS4510K9 Service SMB Advanced Engine

B-55
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Service Engines
Service SMB Advanced Engine
Note The SMB engine has been replaced by the SMB Advanced engine. Even though the SMB engine is still
visible in IDM, IME, and the CLI, its signatures have been obsoleted; that is, the new signatures have
the obsoletes parameter set with the IDs of their corresponding old signatures. Use the new SMB
Advanced engine to rewrite any custom signature that were in the SMB engine.
The Service SMB Advanced engine processes Microsoft SMB and Microsoft RPC over SMB packets.
The Service SMB Advanced engine uses the same decoding me thod for connection-oriented MSRPC as
the MSRPC engine with the requirement that the MSRPC packet must be over the SMB protocol. The
Service SMB Advanced engine supports MSRPC over SMB on TCP ports 139 and 445. It uses a copy
of the connection-oriented DCS/RPC code from the MSRPC engine .
Tabl e B-28 lists the parameters specific to the Service SM B Advanced engine.
TableB-28 Service SMB Advanced Engine Parameters
Parameter Description Value
service-ports Specifies a comma-separated list of ports or
port ranges where the target service resides.
0 to 65535
a-b[,c-d]
1
specify-smb-command {yes
| no}
(Optional) Enables SMB commands:
• smb-command—Specifies the SMB
command value.
Note Exact match required; defines the
SMB packet type.
2
0 to 255
specify-direction {yes | no} (Optional) Enables traffic direction:
• direction—Specifies the direction of
traffic:
– from service—Traffic from service
port destined to client port.
– to service—Traffic from client port
destined to service port.
from service
to service
specify-msrpc-over-smb-op
eration {yes | no}
(Optional) Enables MSRPC over SMB:
• msrpc-over-smb-operation—Specifies
MSRPC over SMB.
Note Required for
SMB_COM_TRANSACTION
commands, exact match required.
0 to 65535
specify-regex-string {yes |
no}
(Optional) Enables searching for Regex
strings:
• regex-string—Specifies a regular
expression to search for in a single TCP
packet.
string