Filter
Top Products
B-67
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix B Signature Engines
String XL Engines
Table B-36 lists the parameters specific to the String XL engines (TCP, ICMP, and UDP).
Table B-36 String XL Engine Parameters
Parameter Description Value
direction (Required) Direction of the traffic to inspect:
• Traffic from service port destined to client
port.
• Traffic from client port destined to service
port.
from-service
to-service
dot-all If set to true, matches [\x00-\xFF] including \n; if
set to false, matches anything in the range
[\x00-\xFF] except \n.
true | false
(default)
end-optional Specifies that at the end of a packet, if all other
conditions are satisfied but the end is not seen, a
match is reported if the minimum is exceeded.
true | false
(default)
icmp-type Specifies the ICMP message type. Required if the
signature engine is string-icmp.
0 to 18
1
a-b[,c-d]
no-case Specifies to treat all alphabetic characters in the
expression as case insensitive.
true | false
(default)
raw-regex If set to true, min-match-length,
max-match-length, min-whole-length,
max-whole-length, dot-all, utf8, no-case, stingy,
and end-optional are not used to reformat the
regular expression string.
Note raw-regex lets you enter a regular
expression string in Raw syntax without
being translated.
true | false
(default)
regex-string (Required) Specifies the Regex pattern to use in
the search.
Note This parameter is required unless
max-stream-length is set. Do not set the
regex-string if max-stream-length is set.
string
service-ports (Required) Specifies a comma-separated list of
ports or port ranges where the target service
resides.
Note This parameter is required for the String
XL TCP and String XL UDP signature
engines. It cannot be used for the String
XL ICMP signature engine.
0 to 65535
1
a-b[,c-d]
specify-exact-match-offset
{yes | No}
Enables exact match offset:
• exact-match-offset—Specifies the exact
stream offset in bytes the regular expression
string must report for a match to be valid.
0 to 65535