Understanding Cisco IDS Signature Series
Understanding Cisco IDS Signature Series
Now we are going to discuss each of the signatures. I have
taken the time to separate them into the numbered series. The signatures range
from 1000 all the way into the 11000s. Besides numerically grouping signatures,
the series number represents another type of grouping. They help the
administrator narrow down what type of attack is generating the alarms. Are they
atomic? Is the attack a string, sweep, or web site exploit? Although the numbers
do cover multiple signature types, they help the administrator narrow down his
search.
The following list gives a brief description of each signature
series.
-
The 1000 series covers the signatures that analyze the
content of IP headers.
-
The 2000 series focuses on ICMP signatures.
-
The 3000 series is all about TCP-based signatures.
-
The 4000 series is all about UPD connections and ports on
the network.
-
The 5000 series is probably the largest. It covers web
(HTTP) traffic.
-
The 6000 series focuses on multiprotocol signatures.
-
The 7000 series has the ARP signatures.
-
The 8000 series is string-matching signatures.
-
The 9000 series covers Back Doors.
-
The 10000 series has signatures that focus on policy
enforcement.
472 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|