B-11
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Appendix B Signature Engines
NORMALIZER Engine
All signature events are handed off to the META engine by SEAP. SEAP hands off the event after
processing the minimum hits option. Summarization and event action are processed after the META
engine has processed the component events.
Caution
A large number of META signatures could adversely affect overall sensor performance.
Table B-9
lists the parameters specific to the META engine.
For an example of a custom META engine signature, see
Example MEG Signature, page 7-33
.
NORMALIZER Engine
The NORMALIZER engine deals with IP fragmentation and TCP normalization. This section describes
the NORMALIZER engine, and contains the following topics:
•
Overview, page B-12
•
NORMALIZER Engine Parameters, page B-12
Table B-9
META Engine Parameters
Parameter
Description
Value
meta-reset-interval
Time in seconds to reset the META signature.
0 to 3600
component-list
List of META components:
•
edit—Edits an existing entry
•
insert—Inserts a new entry into the list:
–
begin—Places the entry at the beginning of the
active list
–
end—Places the entry at the end of the active list
–
inactive—Places the entry into the inactive list
–
before—Places the entry before the specified entry
–
after—Places the entry after the specified entry
•
move—Moves an entry in the list
name1
meta-key
Storage type for the META signature:
•
Attacker address
•
Attacker and victim addresses
•
Attacker and victim addresses and ports
•
Victim address
AaBb
AxBx
Axxx
xxBx
unique-victim-ports
Number of unique victims ports required per META
signature.
1 to 256
component-list-in-order Whether to fire the component list in order.
true | false
