Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
620
Document
ID:
RDWR-ALOS-V2900_AG1302
Matching Groups of Patterns
When a virus or other attack contains multiple patterns or strings, it is useful to combine them into
one group and give the group a name that is easy to remember. When a pattern group is applied to
a deny filter, Alteon matches any of the strings or patterns within that group before denying and
dropping the packet. Up to five (5) patterns can be combined into a single pattern group. Configure
the binary or ASCII pattern strings, group them into a pattern group, name the pattern group, and
then apply the group to a filter.
The filtering commands enable the administrator to define groups of patterns and place them into
groups. By applying the patterns and groups to a deny filter, the packet content can be detected and
thus denied access to the network.
Alteon supports up to 1024 pattern groups.
Note:
The pattern group matching feature is available only if you have purchased and enabled the
Advanced Denial of Service Protection software key.
Alteon supports multi-packet inspection. This allows for the inspection of multiple patterns across
multiple packets in a session. Filtering actions will be taken only after matching all the patterns in
the same given sequence.
For example, assume a chain consisting of multiple patterns numbered 1 through 4. The incoming
packets of the session are first searched for pattern 1. Once pattern 1 of the chain is matched,
subsequent packets of the session are searched for pattern 2 and, if matched, pattern 3 is searched
for and so on, until all the patterns in the chain are matched. The filter action is taken after patterns
1 through 4 are matched.
Note:
A reset frame is sent to the destination device when a Layer 7 deny filter is matched instead
of waiting for a server side timeout. This releases the TCP connection in the destination device.
Similarly, any time a TCP packet is denied, a reset frame is sent.
Depth
Depth is the number of bytes in the IP packet that should be examined from either
the beginning of the packet or from the offset value. For example, if an offset of 12
and a depth of 8 is specified, the search begins at the 13th byte in the IP packet,
and matches 8 bytes. An offset of 12 and depth of 8 encompasses the source IP
address and destination IP address fields in the IP payload.
If no depth is specified in ASCII matches, the exact pattern is matched from the
offset value to the end of the pattern. A depth must be specified for binary matches
that are larger than the pattern length in bytes.
Operation
An operation tells Alteon how to interpret the pattern, offset, and depth criteria.
•
For a string pattern, use the operation eq (equals) to match the content of the
string.
•
Use the operations to find values lt (less than), gt (greater than), or eq (equals)
to the specified binary value. If no operation is specified, the pattern is invalid.
The lt and gt operators can be used for certain attack signatures in which one or
more bytes are less than or greater than a certain value.
Table 53: Pattern Criteria Values
Value
Description
