Lesson 7
Describing Signature
Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-1
Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-2
Signature Engine Overview
• A Signature Engine is a component of the sensor
that supports a category of signatures.
• The Cisco IPS Signature Engines enable you to
tune built-in signatures and create new signatures
unique to your network environment.
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-3
Engine Usage
Engine Category Usage
Atomic Used for single-packet inspection
Flood Used to detect attempts to cause a DoS
Meta Used to perform event correlation on the sensor
Normalizer Used to detect ambiguities and abnormalities in the traffic stream
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-4
Engine Usage (Cont.)
Engine Category Usage
Service Used when Layer 5, 6, and 7 services require protocol analysis
Used for state-based and regular expression–based pattern inspection
State
and alarming functionality for TCP streams
Used for regular expression–based pattern inspection and alarm
String
functionality for multiple transport protocols
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-5
Engine Usage (Cont.)
Engine Category Usage
Sweep Used to detect network reconnaissance
Traffic Used to detect traffic irregularities
Trojan Used to inspect nonstandard protocols
AIC Used for deep-packet inspection of FTP and HTTP traffic
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-6
Engine Parameters
• An engine parameter is a name and value pair.
• The parameter name is defined by its engine.
• Parameter values have limits that are defined by
the engine.
• The parameter name is constant across all
signatures in a particular engine, but the value can
be different for the various signatures in an engine
group.
• Some parameters are common to all engines while
others are engine-specific.
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-7
Atomic Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-8
Atomic Signature Engines
Engine Name Engine Description
Atomic ARP Examines ARP packets
Atomic IP Examines ICMP, IP, TCP, and UDP packets
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-9
Atomic ARP Parameters
Specify
Type of
ARP Sig
Specify
Request
Inbalance
Storage
Key
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-10
Atomic IP Parameters
Fragment
Status: Not
Fragmented
Layer 4
Specify Protocol:
Layer 4 TCP Protocol
Protocol
TCP
Flags:
SYN
TCP
Mask:
Syn, Ack
Specify
Payload
Inspection
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-11
Flood Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-12
Flood Signature Engines
Engine Name Engine Description
Looks for an excessive number of packets sent to a
Flood Net
network segment
Looks for an excessive number of ICMP or UDP packets
Flood Host
sent to a target host
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-13
Flood Net Parameters
Gap
Peaks
Rate
Protocol
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-14
Flood Host Parameters
Rate: 25
Protocol: ICMP
ICMP Type: 8
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-15
Meta Signature Engine
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-16
The Meta Event Generator
Meta Reset Interval = 3 seconds
Signature 5081 Signature 5124 Signature 5114 Signature 3215 Signature 3216
[Link] Access IIS CGI Decode IIS Unicode Attack Dot Dot Execute Dot Dot Crash
NIMDA
Signature 5081+5124+5114+3215+3216 = NIMDA
If the five signatures fire within a three-second interval, the meta signature, NIMDA, fires.
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-17
Meta Engine Parameters
Meta Reset
Interval
Component
List
Component
List in Order
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-18
Normalizer Signature
Engine
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-19
Normalizer Engine
• The normalizer engine detects and corrects
ambiguities and abnormalities in traffic as packets
flow through the data path.
• The traffic the normalizer engine inspects is
guaranteed unambiguous because it is normalized
before it is inspected.
• The normalizer engine performs such functions as
the following:
– Properly sequencing packets in a TCP stream
– Reassembling fragmented IP packets
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-20
Normalizer Engine Parameters
Specify
Fragment
Reassembly
Timeout
Fragment
Specify Reassembly
Hijack Max Timeout
Old ACK
Max Old
ACK
Specify SYN
Flood Max
Embryonic SYN Flood
Max
Embryonic
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-21
Service Signature
Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-22
Service Signature Engines
Engine Name Engine Description
Service DNS Examines TCP and UDP DNS packets
Service FTP Examines FTP traffic
Emergency response engine that supplements the string
Service Generic
and state engines
Service H225 Examines the call signaling and setup in VoIP traffic
Service HTTP Examines HTTP traffic for string-based pattern matching
Service IDENT Examines TCP port 113 traffic
Service MSRPC Examines Microsoft RPC traffic
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-23
Service Signature Engines (Cont.)
Engine Name Engine Description
Service MSSQL Examines traffic used by Microsoft SQL
Service NTP Examines NTP traffic
Service RPC Examines RPC traffic
Service SMB Examines SMB traffic
Service SNMP Examines SNMP traffic
Service SSH Examines SSH traffic
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-24
Service DNS Parameters
Protocol
Specify Query
Src Port 53
Query Src
Port 53
Specify
Query
Value Query
Value
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-25
Service FTP Parameters
Direction
Service Ports
Swap
Attacker
Victim
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-26
Service Generic Parameters
Specify
Dst Port
Dst Port
Specify
Payload Payload
Source Source
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-27
H.323 Calls and the Service H225 Engine
Gatekeeper
H.
)
DP
22
5
(U
RA
S
RA
S
IP QoS Network
(U
5
DP
22
H.
)
H.225 (Q.931) Call Setup (TCP)
Gateway A Gateway B
QoS=quality of service
RAS=registration, admission, and status
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-28
Service H225 Engine
Service H225 engine features:
• TPKT validation and length checking
• Q.931 IE validation and length checking
• Setup message validation
• ASN.1 PER encode error checking
• Regex signatures for text fields in Q.931 IEs
• Signatures that provide regex and length checking
for fields such as URL-ID and e-mail-ID
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-29
Service H225 Parameters
Message
Type:
Q.931
Policy
Type:
Length
Check Value
Range:
Specify Value 1-3
Range: Yes
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-30
Service HTTP Parameters
De-Obfuscate
Specify Request
Regex
Request Regex
Service Ports
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-31
Service Ident Parameters
Inspection
Type
Service Ports
Direction
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-32
Service MSRPC Parameters
Protocol
Regex
String
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-33
Service MSSQL Parameters
Specify SQL
Username
SQL Username
Password Present
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-34
Service NTP Parameters
Inspection Type
Operation Mode
Max Control Data Size
Control Opcode
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-35
Service RPC Parameters
Direction
Protocol
Service
Ports
Specify
RPC RPC
Program Program
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-36
Service SMB Parameters
Service
Ports
Specify
Word
Count
Word
Count
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-37
Service SNMP Parameters
Inspection Type Specify Object ID
Specify Community Name
Community Name
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-38
Service SSH Parameters
Length Type
Service Ports
Specify Packet Depth
Packet Depth
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-39
State Signature Engine
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-40
State Signature Engine
State
Machine
Direction
Service
Ports
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-41
String Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-42
String Signature Engines
Engine Name Engine Description
String ICMP Searches ICMP packets for a string pattern
String TCP Searches TCP packets for a string pattern
String UDP Searches UDP packets for a string pattern
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-43
String ICMP Parameters
Direction
ICMP
Type
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-44
String TCP Parameters
Service
Ports
Direction
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-45
String UDP Parameters
Service
Ports
Direction
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-46
Sweep Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-47
Sweep Signature Engines
Engine Name Engine Description
Detects a single source scanning multiple hosts or
Sweep
multiple ports on one host
Sweep Other TCP Detects odd sweeps and scans such as Queso
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-48
Sweep Engine
• The sweep engine controls the following types of
signatures:
– ICMP
– TCP
– UDP
• Signatures controlled by the sweep engine detect
the following types of sweeps:
– Host sweeps
– Port sweeps
– Service sweeps
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-49
Sweep Engine Parameters
Unique
Protocol
Mask
TCP
Flags
Specify Storage
Port Key
Range
Port
Range
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-50
Sweep Other TCP Engine
• The sweep other TCP Signature Engine supports
signatures that fire when a mixture of TCP packets
with different flags set is detected on the network.
• The sweep other TCP engine does not do Unique
counting like the SWEEP Signature Engine.
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-51
Sweep Other TCP Parameters
TCP
Flags
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-52
Traffic and Trojan
Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-53
Trojan Signature Engines
Engine Name Engine Description
Examines UDP and TCP traffic for nonstandard
Trojan BO2K
BackOrifice traffic
Examines UDP, TCP, or ICMP traffic for irregular traffic
Trojan TFN2K
patterns and corrupted headers
Trojan UDP Examines UDP traffic for Trojan attacks
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-54
Trojan Parameters
TCP
Flags
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-55
Traffic ICMP Parameters
Inspection Type
Want Request
Reply Ratio
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-56
AIC Signature Engines
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-57
AIC Signature Engines
Engine Name Engine Description
AIC FTP Used for FTP-specific policy enforcement
AIC HTTP Used for HTTP-specific policy enforcement
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-58
Enabling Application Policy Enforcement
Configuration Application
Policy
Enable
HTTP
Max HTTP
Requests
AIC Web
Signature Ports
Definition
Enable
FTP
Miscellaneous
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-59
AIC FTP Engine
• Capabilities of the AIC FTP engine:
– Controls which recognized FTP commands are
permitted into the network
– Controls whether unrecognized FTP commands
are permitted into the network
• The AIC FTP engine controls the following types of
signatures:
– Define FTP command: Used to associate an
action with a specific FTP command
– Unrecognized FTP command: Used to have the
sensor take an action when it detects an FTP
command that is not recognized
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-60
AIC FTP Parameter Example
Selected
Engine:
AIC FTP
Unrecognized
FTP command
Enable
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-61
AIC HTTP Engine Capabilities
• Enforcing RFC compliance
• Authorizing and enforcing HTTP request methods
• Validating response messages
• Enforcing MIME types
• Validating transfer encoding types
• Controlling content based on message content and
type of data being transferred
• Enforcing URI length
• Enforcing message size according to policy
configured and the header
• Enforcing tunneling, P2P, and instant messaging
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-62
AIC HTTP Signatures
The AIC HTTP engine controls the following types of
signatures:
• Define Web Traffic Policy: Used to specify whether traffic
not compliant to the HTTP RFC is allowed into the
protected network through web ports
• Content Type: Used for policies associated with MIME
types
• Msg Body Pattern: Used to define patterns the sensor
should look for in an HTTP message
• Request Methods: Used to define policies associated with
HTTP request methods
• Transfer Encodings: Used to define policies associated
with transfer encoding methods
• Max Outstanding Requests Overrun: Used to have the
sensor take an action when the Max HTTP Requests value
is exceeded
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-63
AIC HTTP Parameter Example
Selected Engine:
AIC HTTP
Content Type
image/gif
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-64
AIC HTTP Parameter Example (Cont.)
Event Action
Signature Type
Content Types
Name
Content
Type Details
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-65
Summary
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-66
Summary
• A Signature Engine is a component of the sensor
that supports a category of signatures.
• Each Signature Engine is designed for a specific
type of traffic.
• Each engine has a set of parameters that helps
define the behavior of the signatures controlled by
the engine.
• Parameters can be modified so that signatures
meet the needs of your network environment.
• Cisco IDS signatures can summarize alarms to
reduce the number of single alarms generated.
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—7-67