Radware DefensePro 6.02, Руководство пользователя

Страница: 157 / 339

DefensePro User Guide
Security Configuration
Document ID: RDWR-DP-V0602_UG1201
157
OMPC Parameters
Offset Mask Pattern Condition (OMPC) parameters are a set of attack parameters that define rules
for pattern lookups. The OMPC rules look for a fixed size pattern of up to four bytes that uses fixed
offset masking. This is useful for attack recognition, when the attack signature is a TCP/IP header
field or a pattern in the data/payload in a fixed offset.
OMPC Condition
The OMPC condition.
Values:
• Equal
• Greater Than
• Not Applicable
• Less Than
• Not Equal
Default: Not Applicable
OMPC Length The length of the OMPC (Offset Mask Pattern Condition) data:
Values:
• Not Applicable
• 1 Byte
• 2 Bytes
• 3 Bytes
• 4 Bytes
Default: 1 Byte
OMPC Offset The location in the packet from where data checking starts looking for
specific bits in the IP/TCP header.
Values: 0–1513
Default: 0
OMPC Offset Relative to Specifies to which OMPC offset the selected offset is relative.
Values:
• None
• IP Header
• IP Data
• L4 Data
• L4 Header
• Ethernet
Default: None
OMPC Pattern The fixed size pattern within the packet that OMPC rules attempt to find.
Values: A combination of hexadecimal numbers (0–9, a–f). The value is
defined by the OMPC Length parameter.
The OMPC Pattern definition contain eight symbols. When the OMPC
Length is less than four bytes, complete it with zeros.
For example, when the OMPC Length is two bytes, the OMPC Pattern can
be abcd0000.
Default: 00000000
Parameter Description