B-68
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Sweep Engines
Apply Changes?[yes]: yes
Error: string-xl-tcp 60003.0 : Maximum Stream Length is currently not supported.
Please don't use this option.
The configuration changes failed validation, no changes were applied.
Would you like to return to edit mode to correct the errors? [yes]:
For More Information
•
For more information on the parameters common to all signature engines, see Master Engine,
page B-4
•
For example String XL engine signatures, see Example String XL TCP Engine Match Offset
Signature, page 7-52 and Example String XL TCP Engine Minimum Match Length Signature,
page 7-55.
Sweep Engines
This section describes the Sweep engines, and contains the following topics:
•
Sweep Engine, page B-68
•
Sweep Other TCP Engine, pageB-70

Sweep Engine

The Sweep engine analyzes traffic between two hosts or from one host to many hosts. You can tune the
existing signatures or create custom signat ures. The Sweep engine has protocol-specific parameters for
ICMP, UDP, and TCP.
The alert conditions of the Sweep engine ultimately depend on the count of the unique parameter. The
unique parameter is the threshold number of distinct hosts or ports depending on the type of swee p. The
unique parameter triggers the alert when more than the unique number of ports or hosts is seen on the
address set within the time period. The processing of unique p ort and host tracking is called counting.
Caution
Event action filters based on source and destination IP addresses do not function for the Sweep engine,
because they do not filter as regular signatures. To filter source and destination IP addresses in sweep
alerts, use the source and destination IP address filter parameters in the Sweep engine signatures.
A unique parameter must be specified for all signatures in the Sweep engine. A limit of 2 through 40
(inclusive) is enforced on the sweeps. 2 is the absolute minimum for a sweep, otherwise, it is not a sweep
(of one host or port). 40 is a practical maximum that must be enforced so that the sweep does not
consume excess memory. More realistic values for unique range between 5 and 15.
TCP sweeps must have a TCP flag and mask specified to determine which sweep inspector slot in which
to count the distinct connections. ICMP sweeps must have an ICMP type specified to discriminate
among the various types of ICMP packets.
Data Nodes
When an activity related to Sweep engine signatures is seen, the IPS uses a data node to determine when
it should stop monitoring for a particular host. The data node contains various persistent counters and
variables needed for cross-packet reassembly of stream s and for tracking the inspection state on a