Filter
Top Products
B-65
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix B Signature Engines
String Engines
Table B-35 lists the parameters specific to the String UDP engine.
specify-min-match-
length {yes | no}
(Optional) Enables minimum match length:
• min-match-length—Specifies the minimum
number of bytes the regular expression
string must match.
0 to 65535
strip-telnet-options Strips the Telnet option characters from the data
before the pattern is searched.
2
true | false
swap-attacker-victim Swaps the attacker and victim addresses and
ports (source and destination) in the alert
message and in any actions taken.
true| false (default)
1. The second number in the range must be greater than or equal to the first number.
2. This parameter is primarily used as an IPS anti-evasion tool.
Table B-34 String TCP Engine (continued)
Parameter Description Value
Table B-35 String UDP Engine
Parameter Description Value
direction Specifies the direction of the traffic:
• Traffic from service port destined to client
port.
• Traffic from client port destined to service
port.
• from-service
• to-service
•
regex-string The Regex pattern to use in the search. string
service-ports Specifies a comma-separated list of ports or
port ranges where the target service resides.
0 to 65535
1
a-b[,c-d]
1. The second number in the range must be greater than or equal to the first number.
specify-exact-match-offset
{yes | no}
(Optional) Enables exact match offset:
• exact-match-offset—Specifies the exact
stream offset the regular expression string
must report for a match to be valid.
0 to 65535
specify-min-match-
length {yes | no}
(Optional) Enables minimum match length:
• min-match-length—Specifies the
minimum number of bytes the regular
expression string must match.
0 to 65535
swap-attacker-victim Swaps the attacker and victim addresses and
ports (source and destination) in the alert
message and in any actions taken.
true| false