No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Fat AP and Cloud AP V200R010C00 Command Reference

Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
display ips-signature

display ips-signature

Function

The display ips-signature command displays information about an IPS signature.

Format

display ips-signature ips-signature-id

display ips-signature [ { pre-defined | user-defined } [ associated ] ] [ application { application-name | all } | category { category-name | all } | os { all | android | ios | unix-like | windows | other } * | protocol { protocol-name | all } | severity { information | low | medium | high } * | state { disabled | enabled | retired } | target { server | client | both } ] *

Parameters

Parameter Description Value
ips-signature-id

Specifies the ID of an IPS signature.

The value is an integer ranging from 1 to 16777215.

The value must be the ID of an existing IPS signature.

pre-defined

Displays information about a predefined signature.

-

user-defined

Displays information about a user-defined signature.

-

associated

Displays information about a associated signature.

-

application { application-name | all }

Specifies an application name.

  • application-name: displays information about signatures in application application-name.

  • all: displays information about signatures in all applications.

category { category-name | all }

Displays signatures by category.

  • category-name: displays information about signatures in category category-name.

  • all: displays information about signatures in all categories.

os { all | android | ios | unix-like | windows | other } *

Displays signatures by operating system.

  • all: displays information about all signatures.

  • android: displays information about signatures for the Android operating system.

  • ios: displays information about signatures for the iOS operating system.

  • unix: displays information about signatures for the UNIX operating system.

  • windows: displays information about signatures for the Windows operating system.

  • other: displays information about signatures for other operating systems.

protocol { protocol-name | all }

Displays signatures by protocol.

  • protocol-name: displays information about signatures of protocol protocol-name.
  • all: displays information about signatures of all protocols.
severity { information | low | medium | high }*

Displays signatures by severity.

  • information: displays information about signatures with informational severity.

  • low: displays information about signatures with low severity.

  • medium: displays information about signatures with medium severity.

  • high: displays information about signatures with high severity.

state { disabled | enabled | retired }

Indicates the state of a predefined signature.

  • disabled: The predefined signature is disabled.

  • enabled: The predefined signature is enabled.

  • retired: The predefined signature is deprecated.

target { server | client | both }

Displays signatures by target.

  • server: displays information about signatures for detecting intrusions into a server.

  • client: displays information about signatures for detecting intrusions into a client.

  • both: displays information about signatures for detecting intrusions into both a client and a server.

Views

All views

Default Level

1: Monitoring level

Usage Guidelines

The display ips-signature pre-defined associated command displays information about predefined associated signatures and user-defined associated signature.

If the IPS signature file is not loaded, predefined signatures are not displayed, the protocol cannot be specified, and the category must be set to all. You can upgrade services to load the IPS signature file.

Example

# Display all predefined signatures.

<Huawei> display ips-signature pre-defined
 ----------------------------------------------------------------------------   
 *                          Pre-defined Signature                           *   
 *                             (Counts: 5538)                               *   
 ----------------------------------------------------------------------------   
 Sig-ID   Protocol   Target  Severity OS        Category         Event Counts   
 ----------------------------------------------------------------------------   
 1030     HTTP       server  high     windows   Overflow                    0   
 1040     HTTP       client  high     windows   Overflow                    0   
 1050     TCP        server  high     all       Dos                         0   
 1060     HTTP       server  high     windows   Overflow                    0   
 1080     TCP        server  high     windows   Overflow                    0   
 1090     UDP        server  high     all       Code-execution              0   
 1100     MSRPC      server  high     windows   Overflow                    0   
 1102     MSRPC      server  high     windows   Overflow                    0   
 1110     TCP        both    high     all       Code-execution              0   
 1120     TCP        server  high     all       Overflow                    0   
 1140     IMAP4      server  high     unix-like Code-execution              0   
 1150     MSRPC      server  high     windows   Overflow                    0   
 1160     MSRPC      server  medium   windows   Dos                         0   
 1170     MSRPC      server  medium   windows   Dos                         0   
 1189     TCP        server  medium   windows   Dos                         0   
 1200     SUNRPC     server  high     unix-like Overflow                    0   
 1220     HTTP       client  high     windows   Overflow                    0   
 1230     SUNRPC     server  high     all       Overflow                    0   
  ---- More ----                                                                

# Display all user-defined signatures.

<Huawei> display ips-signature user-defined
 ----------------------------------------------------------------------------   
 *                         User-defined Signature                           *   
 *                              (Counts:   1)                               *   
 ----------------------------------------------------------------------------   
 Sig-ID   Protocol   Target  Severity OS        Category         Event Counts   
 ----------------------------------------------------------------------------   
 1        TCP        both    high     N/A       User-defined                0   
Table 26-141  Description of the display ips-signature pre-defined and display ips-signature user-defined command output

Item

Description

Counts

Number of signatures

Sig-ID

Signature ID

Protocol

Protocol of packets matching the signature

Target

Detection target of the signature

Severity

Severity of intrusions matching the signature

OS

Operating system attacked by intrusions matching the signature

Category

Signature category

Event Counts

Match count of a signature

NOTE:

The Central AP does not clear the match count of a modified or a deleted user-defined signature. When you create a user-defined signature with an ID the same as that of a deleted signature, the match count increases on the basis of the match count of the deleted signature. For example, the match count of user-defined signature 12 is 10, and the signature is deleted using the undo ips signature-id 12 command. If you use the ips signature-id 12 command to create a user-defined signature with the same name 12. The match count of the new user-defined signature 12 is 10.

To clear the match count of a user-defined or predefined signature, run the reset ips-signature statistics command.

# Display the signature with ID 16042.

<Huawei> display ips-signature 16042
 -------------------------------------------------------------------------------                                                    
   SignatureID                         : 16042                                                                                      
   Name                                : VideoLAN VLC ActiveX Control Crafted Parameter Memory Corruption                           
   Protocol                            : TCP                                                                                       
   Target                              : client                                                                                     
   Severity                            : medium                                                                                     
   OS                                  : all                                                                                        
   Category                            : Overflow                                                                                   
   Action                              : alert                                                                                      
   EventCounts                         : 0                                                                                          
   AttackEvidenceCollectionCounts      : 0(slot 0 cpu 0)                                                                            
   Reference                           : CVE:CVE-2007-6262                                                                          
   State                               : enabled                                                                                    
   Description                         : CVE-2007-6262 : A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d 
allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable fu
nction, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."                                 
 -------------------------------------------------------------------------------
Table 26-142  Description of the display ips-signature ips-signature-id command output

Item

Description

SignatureID

Signature ID

Name

Signature name

Protocol

Protocol of packets matching the signature

Target

Detection target of the signature

Severity

Severity of intrusions matching the signature

OS

Operating system attacked by the intrusions matching the signature

Category

Signature category

Action

Signature action

Threshold

Threshold for signature association times

Interval

Measurement period

Correlateby

Association mode

EventCounts

Match count of a signature

NOTE:

To clear the match count of a signature, run the reset ips-signature statistics command.

AttackEvidenceCollectionCounts

Number of attack evidence collection sessions

Reference

Reference information of a signature

  • CVE: indicates the Common Vulnerabilities and Exposures (CVE) ID of a signature. You can query the CVE ID on the http://cve.mitre.org/ website and obtain detailed information based on the CVE ID.

  • BID: indicates the Bugtraq ID (BID) of a signature. You can query the BID on the http://www.securityfocus.com/bid website and obtain detailed information based on the BID.
  • CNNVD: indicates the China National Vulnerability Database of Information Security (CNNVD) ID of a signature. You can query the CNNVD ID on the http://www.cnnvd.org.cn/ website and obtain detailed information based on the CNNVD ID.

State

Signature state

Application

Application to which a signature applies

Description

Description of a signature

Translation
Download
Updated: 2019-11-21

Document ID: EDOC1100064352

Views: 204266

Downloads: 122

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next