Creating custom signatures

Custom signatures

Table 7: UDP header keywords

 

Keyword and Value

Description

 

 

 

 

 

--dst_port [!]{<port_int>

The destination port number.

 

:<port_int> <port_int>:

You can specify a single port or port range:

 

<port_int>:<port_int>};

<port_int> is a single port.

 

 

:<port_int> includes the specified port and

 

 

 

all lower numbered ports.

 

 

<port_int>: includes the specified port and

 

 

 

all higher numbered ports.

 

 

<port_int>:<port_int> includes the two

 

 

 

specified ports and all ports in between.

 

--src_port [!]{<port_int>

The source port number.

 

:<port_int> <port_int>:

You can specify a single port or port range:

 

<port_int>:<port_int>};

<port_int> is a single port.

 

 

:<port_int> includes the specified port and

 

 

 

all lower numbered ports.

 

 

<port_int>: includes the specified port and

 

 

 

all higher numbered ports.

 

 

<port_int>:<port_int> includes the two

 

 

 

specified ports and all ports in between.

Table 8: ICMP keywords

 

 

 

 

 

 

 

Keyword and Value

Usage

 

 

 

 

 

--icmp_code <code_int>;

Specify the ICMP code to match.

 

--icmp_id <id_int>;

Check for the specified ICMP ID value.

 

--icmp_seq <seq_int>;

Check for the specified ICMP sequence value.

 

--icmp_type <type_int>;

Specify the ICMP type to match.

Table 9: Other keywords

 

 

 

 

 

 

 

Keyword and Value

 

Description

 

 

 

 

 

--data_size {<size_int>

 

Test the packet payload size. With data_size

 

<<size_int> ><size_int>

 

specified, packet reassembly is turned off

 

<port_int><><port_int>};

 

automatically. So a signature with data_size

 

 

and only_stream values set is wrong.

 

 

 

 

 

 

<size_int> is a particular packet size.

 

 

 

<<size_int> is a packet smaller than the

 

 

 

specified size.

 

 

 

><size_int> is a packet larger than the

 

 

 

specified size.

 

 

 

<size_int><><size_int> within the

 

 

 

range between the specified sizes.

 

--data_at <offset_int>[,

 

Verify that the payload has data at a specified

 

relative];

 

offset, optionally looking for data relative to the

 

 

 

end of the previous content match.

 

FortiGate IPS User Guide Version 3.0 MR7

32

01-30007-0080-20080916

Page 32
Image 32
Fortinet IPS manual UDP header keywords Keyword and Value Description, Icmp keywords Keyword and Value Usage