B-29
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Appendix B Signature Engines
STRING Engines
STRING Engines
This section describes the STRING engine, and contains the following topics:
•
Overview, page B-29
•
STRING.ICMP Engine Parameters, page B-29
•
STRING.TPC Engine Parameters, page B-30
•
STRING-UDP Engine Parameters, page B-31
Overview
The STRING engine is a generic-based pattern-matching inspection engine for ICMP, TCP, and UDP
protocols. The STRING engine uses a regular expression engine that can combine multiple patterns into
a single pattern-matching table allowing for a single search through the data.
There are three STRING engines: STRING.ICMP, STRING.TCP, and STRING.UDP.
For an example custom STRING engine signature, see
Example STRING.TCP Signature, page 7-30
.
STRING.ICMP Engine Parameters
Table B-25
lists the parameters specific to the STRING.ICMP engine.
specify-min-match-
length
(Optional) Enables minimum match length:
•
min-match-length—Minimum number of bytes the
regular expression string must match.
0 to 65535
swap-attacker-victim
True if address (and ports) source and destination are
swapped in the alert message. False for no swap (default).
true | false
1.
The second number in the range must be greater than or equal to the first number.
Table B-24
STATE Engine Parameters (continued)
Parameter
Description
Value
Table B-25
STRING.ICMP Engine Parameters
Parameter
Description
Value
direction
Direction of the traffic:
•
Traffic from service port destined to client port.
•
Traffic from client port destined to service port.
from-service
to-service
icmp-type
ICMP header TYPE value.
0 to 18
1
a-b[,c-d]