CCSP Self-Study: Securing Cisco IOS Networks (SECUR)

Signatures Used By Cisco IOS IDS

Cisco IOS IDS uses 100 of the most common attack signatures to detect patterns of misuse in network traffic. Fifty-nine of these IDS signatures were provided in Cisco IOS Firewall in versions prior to Release 12.2(11)YU. These signatures identify the most severe breaches of security, common network attacks, and information-gathering scans commonly found in an active network.

Cisco IOS IDS signatures are categorized by severity and complexity:

• Severity

  - Info signatures— Detect information-gathering activities such as port sweeps. There are 39 of these.

  - Attack signatures— Detect malicious activity, such as illegal FTP commands. There are 61 of these.

• Complexity

  - Atomic signatures— Detect simple patterns, such as ...