display ips-signature
Format
display ips-signature ips-signature-id
display ips-signature [ { pre-defined | user-defined } [ associated ] ] [ application { application-name | all } | category { category-name | all } | os { all | android | ios | unix-like | windows | other } * | protocol { protocol-name | all } | severity { information | low | medium | high } * | state { disabled | enabled | retired } | target { server | client | both } ] *
Parameters
| Parameter | Description | Value |
|---|---|---|
| ips-signature-id | Specifies the ID of an IPS signature. |
The value is an integer ranging from 1 to 16777215. The value must be the ID of an existing IPS signature. |
| pre-defined | Displays information about a predefined signature. |
- |
| user-defined | Displays information about a user-defined signature. |
- |
| associated | Displays information about a associated signature. |
- |
| application { application-name | all } | Specifies an application name. |
|
| category { category-name | all } | Displays signatures by category. |
|
| os { all | android | ios | unix-like | windows | other } * | Displays signatures by operating system. |
|
| protocol { protocol-name | all } | Displays signatures by protocol. |
|
| severity { information | low | medium | high }* | Displays signatures by severity. |
|
| state { disabled | enabled | retired } | Indicates the state of a predefined signature. |
|
| target { server | client | both } | Displays signatures by target. |
|
Usage Guidelines
The display ips-signature pre-defined associated command displays information about predefined associated signatures and user-defined associated signature.
If the IPS signature file is not loaded, predefined signatures are not displayed, the protocol cannot be specified, and the category must be set to all. You can upgrade services to load the IPS signature file.
Example
# Display all predefined signatures.
<AC6605> display ips-signature pre-defined
----------------------------------------------------------------------------
* Pre-defined Signature *
* (Counts: 5538) *
----------------------------------------------------------------------------
Sig-ID Protocol Target Severity OS Category Event Counts
----------------------------------------------------------------------------
1030 HTTP server high windows Overflow 0
1040 HTTP client high windows Overflow 0
1050 TCP server high all Dos 0
1060 HTTP server high windows Overflow 0
1080 TCP server high windows Overflow 0
1090 UDP server high all Code-execution 0
1100 MSRPC server high windows Overflow 0
1102 MSRPC server high windows Overflow 0
1110 TCP both high all Code-execution 0
1120 TCP server high all Overflow 0
1140 IMAP4 server high unix-like Code-execution 0
1150 MSRPC server high windows Overflow 0
1160 MSRPC server medium windows Dos 0
1170 MSRPC server medium windows Dos 0
1189 TCP server medium windows Dos 0
1200 SUNRPC server high unix-like Overflow 0
1220 HTTP client high windows Overflow 0
1230 SUNRPC server high all Overflow 0
---- More ----
# Display all user-defined signatures.
<AC6605> display ips-signature user-defined
----------------------------------------------------------------------------
* User-defined Signature *
* (Counts: 1) *
----------------------------------------------------------------------------
Sig-ID Protocol Target Severity OS Category Event Counts
----------------------------------------------------------------------------
1 TCP both high N/A User-defined 0
Item |
Description |
|---|---|
Counts |
Number of signatures |
Sig-ID |
Signature ID |
Protocol |
Protocol of packets matching the signature |
Target |
Detection target of the signature |
Severity |
Severity of intrusions matching the signature |
OS |
Operating system attacked by intrusions matching the signature |
Category |
Signature category |
Event Counts |
Match count of a signature NOTE:
The AC does not clear the match count of a modified or a deleted user-defined signature. When you create a user-defined signature with an ID the same as that of a deleted signature, the match count increases on the basis of the match count of the deleted signature. For example, the match count of user-defined signature 12 is 10, and the signature is deleted using the undo ips signature-id 12 command. If you use the ips signature-id 12 command to create a user-defined signature with the same name 12. The match count of the new user-defined signature 12 is 10. To clear the match count of a user-defined or predefined signature, run the reset ips-signature statistics command. |
# Display the signature with ID 16042.
<AC6605> display ips-signature 16042
-------------------------------------------------------------------------------
SignatureID : 16042
Name : VideoLAN VLC ActiveX Control Crafted Parameter Memory Corruption
Protocol : TCP
Target : client
Severity : medium
OS : all
Category : Overflow
Action : alert
EventCounts : 0
AttackEvidenceCollectionCounts : 0(slot 0 cpu 0)
Reference : CVE:CVE-2007-6262
State : enabled
Description : CVE-2007-6262 : A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d
allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable fu
nction, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."
-------------------------------------------------------------------------------
Item |
Description |
|---|---|
SignatureID |
Signature ID |
Name |
Signature name |
Protocol |
Protocol of packets matching the signature |
Target |
Detection target of the signature |
Severity |
Severity of intrusions matching the signature |
OS |
Operating system attacked by the intrusions matching the signature |
Category |
Signature category |
Action |
Signature action |
Threshold |
Threshold for signature association times |
Interval |
Measurement period |
Correlateby |
Association mode |
EventCounts |
Match count of a signature NOTE:
To clear the match count of a signature, run the reset ips-signature statistics command. |
AttackEvidenceCollectionCounts |
Number of attack evidence collection sessions |
Reference |
Reference information of a signature
|
State |
Signature state |
Application |
Application to which a signature applies |
Description |
Description of a signature |
