B-72
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Traffic Anomaly Engine
•
log-pair-packets—Starts IP logging for packets that contain the attacker and victim address pair.
•
deny-attacker-service-pair-inline—Blocks the source IP address and the destination port.
•
request-snmp-trap—Sends a request to NotificationApp to perform SNMP notification.
•
request-block-host—Sends a request to ARC to block this host (the attacker).
Tabl e B-39 lists the anomaly detec tion worm signatures.
TableB-39 Anomaly Detection Worm Signatures
Signature
ID
Subsignature
ID Name Description
13000 0 Internal TCP Scanner Identified a single scanner over a TCP protocol in
the internal zone.
13000 1 Internal TCP Scanner Identified a worm attack over a TCP protocol in
the internal zone; the TCP histogram threshold
was crossed and a scanner over a TCP protocol
was identified.
13001 0 Internal UDP Scanner Ide ntified a single scanner over a UDP protocol
in the internal zone.
13001 1 Internal UDP Scanner Identified a worm attack over a UDP protocol in
the internal zone; the UDP histogram threshold
was crossed and a scanner over a UDP protocol
was identified.
13002 0 Internal O ther Scanner Identified a single scanner over an Other protocol
in the internal zone.
13002 1 Internal Other Scanner Identified a worm attack over an Other protocol
in the internal zone; the Other histogram
threshold was crossed and a scanner over an
Other protocol was identified.
13003 0 External TCP Scanner Identified a single scanner over a TCP protocol in
the external zone.
13003 1 External TCP Scanner Identified a worm attack over a TCP protocol in
the external zone; the TCP histogram thresh old
was crossed and a scanner over a TCP protocol
was identified.
13004 0 External UDP Scanner Identified a single scanner over a UDP protocol
in the external zone.
13004 1 External UDP Scanner Identified a worm attack over a UDP protocol in
the external zone; the UDP histogram thresho ld
was crossed and a scanner over a UDP protocol
was identified.
13005 0 External Other Scanner Identified a single scanner over an Other protocol
in the external zone.
13005 1 External Other Scanner Identified a worm attack over an Other protocol
in the external zone; the Other histogram
threshold was crossed and a scanner over an
Other protocol was identified.