B-62
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
String Engines
For More Information
For more information on the parameters common to all signature engines, see Master Engine, page B-4.
String Engines
The String engine is a generic-based pattern-matching inspection engine for ICMP, TCP, and UDP
protocols. The String engine uses a regular expression engine that can combine multiple patterns into a
single pattern-matching table allowing for a single search through the data. There are three String
engines: String ICMP, String TCP, and String UDP.
direction Specifies the direction of the traffic:
•
Traffic from service port destined to client port.
•
Traffic from client port destined to service port.
from-service
to-service
service-ports Specifies a comma-separa ted list of ports or port ranges
where the target service resides.
0 to 65535
1
a-b[,c-d]
swap-attacker-victim Swaps the attacker and victim addresses and ports
(source and destination) in the alert message and in any
actions taken.
true| false (default)
specify-exact-match-
offset {yes | no}
(Optional) Enables exact match offset:
•
exact-match-offset—Specifies the exact stream
offset the regular expression string must report for
a match to be valid.
0 to 65535
specify-max-match-o
ffset {yes | no }
(Optional) Enables maximum match offset:
•
max-match-offset—Specifies the maximum stream
offset the regular expression string must report for
a match to be valid.
0 to 65535
specify-min-match-o
ffset {yes | no }
(Optional) Enables minimum match offset:
•
min-match-offset—Specifies the minimum stream
offset the regular expression string must report for
a match to be valid.
0 to 65535
1. The second number in the range must be greater than or equal to the first number.
TableB-32 State Engine Parameters (continued)
Parameter Description Value