Cisco Systems IPS4510K9 manual String XL Engines

Appendix B Signature Engines

String XL Engines

String XL Engines

Note The IPS 4345, IPS 4360, IPS 4510, IPS 4520, ASA 5525-X IPS SSP, ASA 5545-X IPS SSP, ASA 5555-X IPS SSP, and ASA 5585-X IPS SSP support the String XL engines and the Regex accelerator card.

The String XL engines do the same thing as the other String engines—provide a matching capability of one string per signature—but they use a different Regex syntax.The String TCP XL engine is stream-based and uses cross-packet inspection (XPI). The packets must be in order. UDP and ICMP are both stateless, thus the String UDP XL and String ICMP XL signature engines require no session state to be allocated and so each packet is a separate search.

The Regex accelerator card is used for both the standard String engines and the String XL engines. Most standard String engine signatures can be compiled and analyzed by the Regex accelerator card without modification. However, there are special circumstances in which the standard String engine signatures cannot be compiled for the Regex accelerator card. In these situations a new signature is written in a String XL engine using the specific parameters in the String XL engine that do compile on the Regex accelerator card. The new signature in the String XL engine obsoletes the original signature in the standard String engine.

Although you can use regular expression syntax or raw expression syntax, raw expression syntax is for expert users only. When configuring String XL signatures, the regex-string parameter is required unless you are using raw expression syntax.

Note Raw Regex is regular expression syntax used for raw mode processing. It is expert mode only and targeted for use by the Cisco IPS signature development team or only those who are under supervision by the Cisco IPS signature development team. You can configure a String XL signature in either regular Regex or raw Regex.

Table B-36lists the parameters specific to the String XL engines (TCP, ICMP, and UDP).

	Table B-36	String XL Engine Parameters
	Parameter		Description	Value
	direction		(Required) Direction of the traffic to inspect:	from-service
			• Traffic from service port destined to client	to-service
			port.
			• Traffic from client port destined to service
			port.
	dot-all		If set to true, matches [\x00-\xFF] including \n;	true false (default)
			if set to false, matches anything in the range
			[\x00-\xFF] except \n.
	end-optional		Specifies that at the end of a packet, if all other	true false (default)
			conditions are satisfied but the end is not seen,
			a match is reported if the minimum is exceeded.
	icmp-type		Specifies the ICMP message type. Required if	0 to 181
			the signature engine is string-icmp.	a-b[,c-d]
		Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01					B-65