B-67
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
String XL Engines
Unsupported String XL Parameters
Although you see the end-optional and specify-max-stream-length parameters in the String XL engine,
they are disabled. You receive an error message if you try to configure them. For example, here is the
error message you receive after you create a signature using specify-max-stream-len gth and then try to
save it:
specify-min-match-
length {yes | No}
Enables minimum match length:
•
min-match-length—Specifies the
minimum number of bytes the regular
expression string must match for the
pattern to be considered a hit.
0 to 65535
specify-max-stream-
length {yes | No}
Enables maximum stream length:
•
max-stream-
length—Limits the search to the first
configured number of bytes. The length of
the stream is checked again this value. If
the stream contains more bytes than this
value, an alert is triggered.
Note
When you specify this parameter, you
cannot configure raw-regex or
regex-string.
yes | no
0 to 65535
specify-max-whole-
length {yes | No}
Enables maximum whole length:
•
max-whole-length—Specifies the
maximum length for the pattern that will
not be fragmented.
yes | no
0 to 65535
specify-min-whole-
length {yes | No}
Enables minimum whole length:
•
min-whole-length—Specifies the
minimum length for the pattern that will
not be fragmented.
yes | no0 to 65535
stingy Sp ecifies to stop looking for larger matches
after the first completed match.
Note
stingy can only be used with
min-match-length; otherwise, it is
ignored.
true | false (default)
strip-telnet-options Strips the Telnet option characters from the data
before the pattern is searched.
2
true | false (default)
swap-attacker-victim True if address (and ports) source and
destination are swapped in the alert message.
False for no swap (default).
true| false (default)
utf8 Treats all legal UTF-8 byte sequences in the
expression as a single character.
true | false (default)
1. The second number in the range must be greater than or equal to the first number.
2. This parameter is primarily used as an IPS anti-evasion tool.
TableB-36 String XL Engine Parameters (continued) (continued)
Parameter Description Value