Cisco Systems IPS4510K9 manual Unsupported String XL Parameters

Appendix B Signature Engines

String XL Engines

Table B-36	String XL Engine Parameters (continued) (continued)
Parameter		Description		Value
specify-min-match-		Enables minimum match length:		0 to 65535
length {yes No}		•	min-match-length—Specifies the
			minimum number of bytes the regular
			expression string must match for the
			pattern to be considered a hit.
specify-max-stream-		Enables maximum stream length:		yes no
length {yes No}		• max-stream-		0 to 65535
			length—Limits the search to the first
			configured number of bytes. The length of
			the stream is checked again this value. If
			the stream contains more bytes than this
			value, an alert is triggered.
		Note When you specify this parameter, you
			cannot configure raw-regex or
			regex-string.
specify-max-whole-		Enables maximum whole length:		yes no
length {yes No}		•	max-whole-length—Specifies the	0 to 65535
			maximum length for the pattern that will
			not be fragmented.
specify-min-whole-		Enables minimum whole length:		yes no0 to 65535
length {yes No}		•	min-whole-length—Specifies the
			minimum length for the pattern that will
			not be fragmented.
stingy		Specifies to stop looking for larger matches		true false (default)
		after the first completed match.
		Note stingy can only be used with
			min-match-length; otherwise, it is
			ignored.
strip-telnet-options		Strips the Telnet option characters from the data		true false (default)
		before the pattern is searched.2
swap-attacker-victim		True if address (and ports) source and		true false (default)
		destination are swapped in the alert message.
		False for no swap (default).
utf8		Treats all legal UTF-8 byte sequences in the		true false (default)
		expression as a single character.

1.The second number in the range must be greater than or equal to the first number.

2.This parameter is primarily used as an IPS anti-evasion tool.

Unsupported String XL Parameters

Although you see the end-optional and specify-max-stream-length parameters in the String XL engine, they are disabled. You receive an error message if you try to configure them. For example, here is the error message you receive after you create a signature using specify-max-stream-length and then try to save it:

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-67