Understanding Cisco IDS Signature Series

Now we are going to discuss each of the signatures. I have taken the time to separate them into the numbered series. The signatures range from 1000 all the way into the 11000s. Besides numerically grouping signatures, the series number represents another type of grouping. They help the administrator narrow down what type of attack is generating the alarms. Are they atomic? Is the attack a string, sweep, or web site exploit? Although the numbers do cover multiple signature types, they help the administrator narrow down his search.

• The 1000 series covers the signatures that analyze the content of IP headers.

• The 2000 series focuses on ICMP signatures.

• The 3000 series is all about TCP-based signatures.

• The 4000 series is all about UPD connections and ports on the network.

• The 5000 series is probably the largest. It covers web (HTTP) traffic.

• The 6000 series focuses on multiprotocol signatures.

• The 7000 series has the ARP signatures.

• The 8000 series is string-matching signatures.

• The 9000 series covers Back Doors.

• The 10000 series has signatures that focus on policy enforcement.