Network Security Principles and Practices

Types of Signatures

All signatures on the Cisco IDS are divided into various categories based on the types of attacks they do pattern matching for. Table 15-4 outlines the various types of signatures available on the Cisco IDS.

Table 15-4. Various Signature Types Divided into the IDS Signature Categories

Signature Category	Signature Types
1000 series—IP signatures	IP options IP fragmentation Bad IP packets
2000 series—ICMP signatures	ICMP traffic records Ping sweeps ICMP attacks
3000 series—TCP signatures	TCP traffic records TCP port scans TCP host sweeps Mail attacks FTP attacks Legacy CIDS web attacks (signature IDs 3200 through 3233) NetBIOS attacks SYN flood and TCP hijack attacks TCP applications
4000 series—UDP signatures	UDP traffic records UDP ...