Cisco Systems IPS4510K9 manual Traffic Anomaly Engine, Sweep Other TCP Engine Parameters

Appendix B Signature Engines

Traffic Anomaly Engine

Sweep Other TCP Engine Parameters

Table B-38lists the parameters specific to the Sweep Other TCP engine.

Table B-38	Sweep Other TCP Engine Parameters
Parameter		Description		Value
specify-port-range		(Optional) Enables using a port range for inspection:		0 to 65535
{yes no}		• port-range—Specifies the UDP port range used in		a-b[,c-d]
		inspection.
set-tcp-flags		Lets you set TCP flags to match.		urg
		• tcp-flags—Specifies the TCP flags used in this		ack
		inspection:		psh
		–	URG bit	rst
		–	ACK bit	syn
		–	PSH bit	fin
		–	RST bit
		–	SYN bit
		–	FIN bit

For More Information

For more information on the parameters common to all signature engines, see Master Engine, page B-4.

Traffic Anomaly Engine

Note You can edit or tune anomaly detection signatures but you cannot create custom anomaly detection signatures.

The Traffic Anomaly engine contains nine anomaly detection signatures covering the three protocols (TCP, UDP, and other). Each signature has two subsignatures, one for the scanner and the other for the worm-infected host (or a scanner under worm attack). When anomaly detection discovers an anomaly, it triggers an alert for these signatures. All anomaly detection signatures are enabled by default and the alert severity for each one is set to high.

When a scanner is detected but no histogram anomaly occurred, the scanner signature fires for that attacker (scanner) IP address. If the histogram signature is triggered, the attacker addresses that are doing the scanning each trigger the worm signature (instead of the scanner signature). The alert details state which threshold is being used for the worm detection now that the histogram has been triggered. From that point on, all scanners are detected as worm-infected hosts.

The following anomaly detection event actions are possible:

•produce-alert—Writes the event to the Event Store.

•deny-attacker-inline—Does not transmit this packet and future packets originating from the attacker address for a specified period of time.

•log-attacker-packets—Starts IP logging for packets that contain the attacker address.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-71