B-64
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
String Engines
Tabl e B-35 lists the parameters specific to the String UDP engine.
For More Information
For an example custom String engine signature, see Example String TCP Engine Signature, page7-41.
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
specify-min-match-
length {yes | no}
(Optional) Enables minimum match length:
•
min-match-length—Specifies the minimum
number of bytes the regular expression
string must match.
0 to 65535
strip-telnet-options Strips the Telnet option characters from the data
before the pattern is searched.
2
true | false
swap-attacker-victim Swaps the attacker and victim addresses and
ports (source and destination) in the alert
message and in any actions taken.
true| false (default)
1. The second number in the range must be greater than or equal to the first number.
2. This parameter is primarily used as an IPS anti-evasion tool.
TableB-34 String TCP Engine (continued)
Parameter Description Value
TableB-35 String UDP Engine
Parameter Description Value
direction Specifies the direction of the traffic:
•
Traffic from service port destined to client
port.
•
Traffic from client port destined to service
port.
•
from-service
•
to-service
•
regex-string The Regex pattern to use in the search. string
service-ports Specifies a comma-separated list of ports or
port ranges where the target service resides.
0 to 65535
1
a-b[,c-d]
1. The second number in the range must be greater than or equal to the first number.
specify-exact-match-offset
{yes | no}
(Optional) Enables exact match offset:
•
exact-match-offset—Specifies the exact
stream offset the regular expression string
must report for a match to be valid.
0 to 65535
specify-min-match-
length {yes | no}
(Optional) Enables minimum match length:
•
min-match-length—Specifies the
minimum number of bytes the regular
expression string must match.
0 to 65535
swap-attacker-victim Swaps the attacker and victim addresses and
ports (source and destination) in the alert
message and in any actions taken.
true| false