SIGNATURES

[ LiB ]

70. IDS signature EventActions take one or all of the following actions: TCP reset ( Reset ), IP log ( Log ), block host ( ShunHost ), block connection ( ShunConnection ), or ZERO .

71. Pre-block ACL Entries that the sensor will place at the beginning of the new ACL before any sensor blocking entries.

72. Post-block ACL ACL entries that the sensor should place after the sensor blocking entries.

73. Flood signature engine Used to detect attempts to cause DoS.

74. Sweep signature engine Used to detect network reconnaissance traffic.

75. Services signature engine Uses Layers 5, 6, and 7 and are operating systemindependent.

76. Trojan signature engine Cannot be used to create custom signatures.

77. Protected parameters Cannot be changed for the default signatures. However, they can be changed for custom signatures.

78. Required parameters Must be defined for all signatures, both default and custom.

79. Master parameters Common to most signatures and exist in most signature engines.

80. Local signature parameters Engine-specific.

81. Regular expressions searching for the text "Secret" or "secret" use the syntax [Ss]ecret .

82. The PortRange parameter with a value of ZERO means that all ports will be inspected.

83. Signature engine Atomic.L3.IP can be used to detect attacks which make use of routing protocols such as Border Gateway Protocol (BGP) and Enhanced Interior Gateway Routing Protocol (EIGRP) at layer 3.

84. Automatic IP logging captures entire IP packets into a log file. It is not enabled by default and must be configured.

[ LiB ]