Cisco Systems IPS4510K9 Traffic Anomaly Engine

B-71
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Traffic Anomaly Engine
Sweep Other TCP Engine Parameters
Tabl e B-38 lists the parameters specific to the Sweep Othe r TCP engine.
For More Information
For more information on the parameters common to all signature engines, see Master Engine, page B-4.
Traffic Anomaly Engine
Note You can edit or tune anomaly detection signatures but you cannot create custom anomaly detection
signatures.
The Traffic Anomaly engine contains nine anomaly detection signatures covering the three protocols
(TCP, UDP, and other). Each signature has two subsignatures, one for the scanner and the other for the
worm-infected host (or a scanner under worm attack). When anomaly detection discovers an anomaly, it
triggers an alert for these signatures. All anomaly detection signatures are enabled by default and the
alert severity for each one is set to high.
When a scanner is detected but no histogram anomaly occurred, the scanner signature fires for that
attacker (scanner) IP address. If the histogram signature is triggered, the attacker address es that are doing
the scanning each trigger the worm signature (instead of the scanner signature). The a lert details state
which threshold is being used for the worm detection now that the histogram has been triggered. From
that point on, all scanners are detected as worm-infected hosts.
The following anomaly detection event actions are possible:
• produce-alert—Writes the event to the Event Store.
• deny-attacker-inline—Does not transmit this packet and future packets originating from the attacker
address for a specified period of time.
• log-attacker-packets—Starts IP logging for packets that contain the attacker address.
TableB-38 Sweep Other TCP Engine Parameters
Parameter Description Value
specify-port-range
{yes | no}
(Optional) Enables using a port range for inspection:
• port-range—Specifies the UDP port range u sed in
inspection.
0 to 65535
a-b[,c-d]
set-tcp-flags Lets you set TCP flags to match.
• tcp-flags—Specifies the TCP flags used in this
inspection:
– URG bit
– ACK bit
– PSH bit
– RST bit
– SYN bit
– FIN bit
urg
ack
psh
rst
syn
fin