Creating custom signatures | Custom signatures |
Table 7: UDP header keywords
| Keyword and Value | Description | |
|
|
|
|
| The destination port number. | ||
| :<port_int> <port_int>: | You can specify a single port or port range: | |
| <port_int>:<port_int>}; | • <port_int> is a single port. | |
|
| • :<port_int> includes the specified port and | |
|
|
| all lower numbered ports. |
|
| • <port_int>: includes the specified port and | |
|
|
| all higher numbered ports. |
|
| • <port_int>:<port_int> includes the two | |
|
|
| specified ports and all ports in between. |
| The source port number. | ||
| :<port_int> <port_int>: | You can specify a single port or port range: | |
| <port_int>:<port_int>}; | • <port_int> is a single port. | |
|
| • :<port_int> includes the specified port and | |
|
|
| all lower numbered ports. |
|
| • <port_int>: includes the specified port and | |
|
|
| all higher numbered ports. |
|
| • <port_int>:<port_int> includes the two | |
|
|
| specified ports and all ports in between. |
Table 8: ICMP keywords |
|
| |
|
|
|
|
| Keyword and Value | Usage | |
|
|
|
|
| Specify the ICMP code to match. | ||
| Check for the specified ICMP ID value. | ||
| Check for the specified ICMP sequence value. | ||
| Specify the ICMP type to match. | ||
Table 9: Other keywords |
|
| |
|
|
|
|
| Keyword and Value |
| Description |
|
|
|
|
|
| Test the packet payload size. With data_size | |
| <<size_int> ><size_int> |
| specified, packet reassembly is turned off |
| <port_int><><port_int>}; |
| automatically. So a signature with data_size |
|
| and only_stream values set is wrong. | |
|
|
| |
|
|
| • <size_int> is a particular packet size. |
|
|
| • <<size_int> is a packet smaller than the |
|
|
| specified size. |
|
|
| • ><size_int> is a packet larger than the |
|
|
| specified size. |
|
|
| • <size_int><><size_int> within the |
|
|
| range between the specified sizes. |
|
| Verify that the payload has data at a specified | |
| relative]; |
| offset, optionally looking for data relative to the |
|
|
| end of the previous content match. |
| FortiGate IPS User Guide Version 3.0 MR7 |
32 |