B-65
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
String XL Engines
String XL Engines
Note
The IPS 4345, IPS 4360, IPS 4510, IPS 4520, ASA 5525-X IPS SSP, ASA 5545-X IPS SSP,
ASA 5555-X IPS SSP, and ASA5585- X IPS SSP support the String XL engines and the Regex
accelerator card.
The String XL engines do the same thing as the other String engines—provide a matching capability of
one string per signature—but they use a different Regex syntax.The String TCP XL engine is
stream-based and uses cross-packet inspec tion (XPI). The packets must be in order. UDP and ICMP are
both stateless, thus the String UDP XL and String ICMP XL signature engines require no session state
to be allocated and so each packet is a separate search.
The Regex accelerator card is used for both the standard String engines and the String XL engines. Most
standard String engine signatures can be compiled and analyzed by the Regex accelerator card without
modification. However, there are special circumstances in which the standard String engine signatures
cannot be compiled for the Regex accelerator card. In these situations a new signature is written in a
String XL engine using the specific parameters in the String XL engine that do c ompile on the Regex
accelerator card. The new signature in the String XL engine o bsoletes the original signature in the
standard String engine.
Although you can use regular expression syntax or raw expression syntax, raw expression syntax is for
expert users only. When configuring String XL signatures, the regex-string parameter is required unless
you are using raw expression syntax.
Note
Raw Regex is regular expression syntax used for raw mode processing. It is expert mode only and
targeted for use by the Cisco IPS signature development team or only those who are under supervision
by the Cisco IPS signature development team. You can configure a String XL signature in either regular
Regex or raw Regex.
Tabl e B-36 lists the parameters specific to the String XL engines (TCP, ICMP, and UDP).
TableB-36 String XL Engine Parameters
Parameter Description Value
direction (Required) Direction of the traffic to inspect:
•
Traffic from service port destined to client
port.
•
Traffic from client port destined to service
port.
from-service
to-service
dot-all If set to true, matches [\x00-\xFF] including \n;
if set to false, matches anything in the range
[\x00-\xFF] except \n.
true | false (default)
end-optional Specifies that at the end of a packet, if all other
conditions are satisfied but the end is not seen,
a match is reported if the minimum is exceeded.
true | false (default)
icmp-type Specifies the ICMP message type. Required if
the signature engine is string-icmp.
0 to 18
1
a-b[,c-d]