topic Signature Fields Details in Network Security https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729749#M64918 <HTML><HEAD></HEAD><BODY><P>Thanks</P></BODY></HTML> Fri, 01 Jul 2011 09:01:22 GMT Bethuelle 2011-07-01T09:01:22Z Signature Fields Details https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729747#M64914 <P><IMG src="https://community.cisco.com/legacyfs/online/legacy/1/6/3/51361-ipsA.jpg" alt="ipsA.jpg" class="jive-image-thumbnail jive-image" onclick="" width="450" /></P><P></P><P>Can someone please give me the meaning and use of the fields found under <EM><STRONG>ENGINE</STRONG></EM>. To be more precise, I'll like to know how to use the fields <STRONG><EM>Src Addr Filter</EM></STRONG> and <STRONG><EM>Dst Addr Filter</EM></STRONG>.</P><P></P><P>Thanks for your answers.</P> Sun, 10 Mar 2019 12:23:33 GMT https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729747#M64914 Bethuelle 2019-03-10T12:23:33Z Signature Fields Details https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729748#M64916 <HTML><HEAD></HEAD><BODY><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">Can someone please give me the meaning and use of the fields found under <EM><STRONG>ENGINE</STRONG></EM>.</PRE><P></P><P><A class="jive-link-external-small" href="http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_signature_engines.html#wpmkr1183504">http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_signature_engines.html#wpmkr1183504</A></P><P></P><P></P><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">To be more precise, I'll like to know how to use the fields <STRONG><EM>Src Addr Filter</EM></STRONG> and <STRONG><EM>Dst Addr Filter</EM></STRONG>.</PRE><P>Detailed by the document in the URL I provided above. In short: EAFs (Event Action Filters) based on Attacker (source) and Victim (destination) IP addresses do not always function as expected for Sweep Engine signatures. To filter Sweep Engine signatures (based on source and/or destination IP addresses), you can use the <EM>Src Addr Filter</EM> and <EM>Dst Addr Filter</EM> parameters for the signature(s) itself.</P></BODY></HTML> Thu, 30 Jun 2011 18:15:18 GMT https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729748#M64916 Dustin Ralich 2011-06-30T18:15:18Z Signature Fields Details https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729749#M64918 <HTML><HEAD></HEAD><BODY><P>Thanks</P></BODY></HTML> Fri, 01 Jul 2011 09:01:22 GMT https://community.cisco.com/t5/network-security/signature-fields-details/m-p/1729749#M64918 Bethuelle 2011-07-01T09:01:22Z