Cisco Systems® releases IOS intrusion prevention system (IPS) signatures in the form of "S-files", which are lists of signatures and their characteristics. Cisco S-files contain signatures for all Cisco IPS platforms: Cisco IPS 42xx sensors, Cisco ASA 55xx appliances, intrusion detection system (IDS) modules for Cisco Catalyst® 6500 Series switches, and Cisco IOS® IPS. As Cisco creates new signatures, it updates the S-files and increments the file name (e.g. S294 as of August 2007). Cisco IOS IPS supports most, but not all, of the signatures in the S-files. This is because the other platforms (e.g. 42xx sensors) support additional "IPS inspection engines" that Cisco IOS IPS currently does not. Future Cisco IOS IPS releases may add support for these inspection engines.
The total number of signatures supported by Cisco IOS IPS routers depends on the Cisco IOS Software release and the signature distribution package version.
In Cisco IOS Software Release 12.3(14)T, Cisco IOS IPS added support for three STRING engines-STRING.TCP, STRING.UDP, and STRING.ICMP. Adding these engines resulted in a large number of new signatures being supported on Cisco IOS IPS routers. As of signature package IOS-S294.zip, the total number of signatures supported by Cisco IOS Software Release 12.3(14)T or later is 1700 (out of a total of 2011 signatures in the S294 file). Because of this and other IPS enhancements, Cisco recommends running Cisco IOS Software Release 12.4(4)T or later when using Cisco IOS IPS.
The following table lists all signatures supported in the IOS-S294.zip signature file, as of Cisco IOS Software Release 12.3(14)T or later. The list is sorted by signature ID. The signature name and signature engine information are also listed.
MULTI-STRING engine support Trend Labs and Cisco Incident Control System (ICS); performance improvement; Distributed Threat Mitigation (DTM)
12.4(2)T
Layer 2 Transparent IPS support
12.3(14)T
Support for three string engines (STRING.TCP, STRING.UDP, and STRING.ICMP)
12.3(8)T
Support for Security Device Event Exchange (SDEE) protocol and for ATOMIC.IP, ATOMIC.ICMP, ATOMIC.IPOPTIONS, ATOMIC.UDP, ATOMIC.TCP, SERVICE.DNS, SERVICE.RPC, SERVICE.SMTP, SERVICE.HTTP, SERVICE.FTP, and OTHER engines
The following table lists all signatures supported in Cisco IOS Software Release 12.3(14)T or later as of IOS-S294.zip file. Signatures are sorted by Signature ID. Signature name and signature engine information are also listed.
