Example String.tcp Signature - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Creating Custom Signatures

Example STRING.TCP Signature

The following example demonstrates how to create a custom STRING.TCP signature.
This procedure also applies to string UDP and ICMP signatures.
Note
The following options apply to the STRING.TCP engine:
•
•
•
•
•
•
•
•
•
•
To create a signature based on the STRING.TCP engine, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Step 3 Specify a signature ID and subsignature ID for the signature:
sensor(config-sig)# signatures 60025 0
Custom signatures are in the range of 60000 to 65000.
Enter signature description submode:
Step 4
sensor(config-sig-sig)# sig-description
Specify a name for the new signature:
Step 5
sensor(config-sig-sig-sig)# sig-name This is my new name
Exit signature description submode:
Step 6
sensor(config-sig-sig-sig)# exit
Specify the string TCP engine:
Step 7
sensor(config-sig-sig)# engine string-tcp
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
7-30
default—Sets the value back to the system default setting.
direction—Direction of the traffic:
from-service—Traffic from service port destined to client port.
–
to-service—Traffic from client port destined to service port.
–
event-action—Action(s) to perform when alert is triggered.
no—Removes an entry or selection setting.
regex-string —A regular expression to search for in a single TCP packet.
service-ports—Ports or port ranges where the target service may reside.
The valid range is 0 to 65535. It is a separated list of integer ranges a-b[,c-d] within 0 to 65535. The
second number in the range must be greater than or equal to the first number.
specify-exact-match-offset [yes | no]—Enables exact-match-offset (optional).
specify-min-match-length [yes | no]—Enables min-match-length (optional).
strip-telnet-options—Strips Telnet option characters from data before searching.
swap-attacker-victim [true | false]—Whether address (and ports) source and destination are
swapped in the alarm message. The default is false for no swapping.
Chapter 7 Defining Signatures
78-16527-01