B-27
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Appendix B Signature Engines
STATE Engine
SERVICE.SSH Engine
The SERVICE.SSH engine specializes in port 22 SSH traffic. Because all but the setup of an SSH session
is encrypted, the engine only looks at the fields in the setup. There are two default signatures for SSH.
You can tune these signatures, but you cannot create custom signatures.
Table B-23
lists the parameters specific to the SERVICE.SSH engine.
STATE Engine
The STATE engine provides state-based regular expression-based pattern inspection of TCP streams. A
state engine is a device that stores the state of something and at a given time can operate on input to
transition from one state to another and/or cause an action or output to take place. State machines are
used to describe a specific event that causes an output or alarm.
non-snmp-traffic-inspection
Inspects for non-SNMP traffic destined for UDP
port 161.
—
snmp-inspection
Inspects SNMP traffic:
•
specify-community-name [yes | no]:
–
community-name—Searches for the
SNMP community name, that is, the
SNMP password.
•
specify-object-id [yes | no]:
–
object-id—Searches for the SNMP object
identifier.
community-name
object-id
Table B-22
SERVICE.SNMP Engine Parameters (continued)
Parameter
Description
Value
Table B-23
SERVICE.SSH Engine Parameters
Parameter
Description
Value
length-type
Inspects for one of the following SSH length types:
•
key-length—Length of the SSH key to inspect for:
–
length—Keys larger than this fire the RSAREF
overflow.
•
user-length—User length SSH inspection:
–
length—Keys larger than this fire the RSAREF
overflow.
0 to 65535
service-ports
A comma-separated list of ports or port ranges where the
target service resides.
0 to 65535
1
a-b[,c-d]
1.
The second number in the range must be greater than or equal to the first number.
specify-packet-depth
(Optional) Enables packet depth:
•
packet-depth—Number of packets to watch before
determining the session key was missed.
0 to 65535