Cisco Systems IPS4510K9 manual Traffic Icmp Engine

Appendix B Signature Engines

Traffic ICMP Engine

Table B-39		Anomaly Detection Worm Signatures (continued)
Signature	Subsignature
ID	ID		Name	Description
13006	0		Illegal TCP Scanner	Identified a single scanner over a TCP protocol in
				the illegal zone.
13006	1		Illegal TCP Scanner	Identified a worm attack over a TCP protocol in
				the illegal zone; the TCP histogram threshold
				was crossed and a scanner over a TCP protocol
				was identified.
13007	0		Illegal UDP Scanner	Identified a single scanner over a UDP protocol
				in the illegal zone.
13007	1		Illegal UDP Scanner	Identified a worm attack over a UDP protocol in
				the illegal zone; the UDP histogram threshold
				was crossed and a scanner over a UDP protocol
				was identified.
13008	0		Illegal Other Scanner	Identified a single scanner over an Other protocol
				in the illegal zone.
13008	1		Illegal Other Scanner	Identified a worm attack over an Other protocol
				in the illegal zone; the Other histogram threshold
				was crossed and a scanner over an Other protocol
				was identified.

For More Information

For more information on the parameters common to all signature engines, see Master Engine, page B-4.

Traffic ICMP Engine

The Traffic ICMP engine analyzes nonstandard protocols, such as TFN2K, LOKI, and DDoS. There are only two signatures (based on the LOKI protocol) with user-configurable parameters.

TFN2K is the newer version of the TFN. It is a DDoS agent that is used to control coordinated attacks by infected computers (zombies) to target a single computer (or domain) with bogus traffic floods from hundreds or thousands of unknown attacking hosts. TFN2K sends randomized packet header information, but it has two discriminators that can be used to define signatures. One is whether the L3 checksum is incorrect and the other is whether the character 64 ‘A’ is found at the end of the payload. TFN2K can run on any port and can communicate with ICMP, TCP, UDP, or a combination of these protocols.

LOKI is a type of back door Trojan. When the computer is infected, the malicious code creates an ICMP Tunnel that can be used to send small payload in ICMP replies (which may go straight through a firewall if it is not configured to block ICMP.) The LOKI signatures look for an imbalance of ICMP echo requests to replies and simple ICMP code and payload discriminators.

The DDoS category (excluding TFN2K) targets ICMP-based DDoS agents. The main tools used here are TFN and Stacheldraht. They are similar in operation to TFN2K, but rely on ICMP only and have fixed commands: integers and strings.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		B-73