Filter
Top Products
B-36
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix B Signature Engines
Multi String Engine
For More Information
• For an example of a custom Meta engine signature, see Example Meta Engine Signature, page 8-47.
• For more information on the parameters common to all signature engines, see Master Engine,
page B-4.
• For more information on Signature Event Action Processor, see Signature Event Action Processor,
page 7-3.
Multi String Engine
Caution The Multi String engine can have a significant impact on memory usage.
The Multi String engine lets you define signatures that inspect Layer 4 transport protocol (ICMP, TCP,
and UDP) payloads using multiple string matches for one signature. You can specify a series of regular
expression patterns that must be matched to fire the signature. For example, you can define a signature
that looks for regex 1 followed by regex 2 on a UDP service. For UDP and TCP you can specify port
numbers and direction. You can specify a single source port, a single destination port, or both ports. The
string matching takes place in both directions.
Use the Multi String engine when you need to specify more than one Regex pattern. Otherwise, you can
use the String ICMP, String TCP, or String UDP engine to specify a single Regex pattern for one of those
protocols.
Table B-16 lists the parameters specific to the Multi String Engine.
Table B-16 Multi String Engine Parameters
Parameter Description Value
inspect-length Specifies the length of the stream or packet
that must contain all offending strings for the
signature to fire.
0 to 4294967295
protocol Specifies the Layer 4 protocol selection. icmp
tcp
udp
regex-component Specifies the list of Regex components:
• regex-string—Specifies the string to
search for.
• spacing-type—Specifies the type of
spacing required from the match before or
from the beginning of the stream/packet if
it is the first entry in the list.
list (1 to 16 items)
exact
minimum