inspect

[iec1128759]

hello, anyone can help me to know about the "inspect". I need to know what apects the inspect can check (TCP, ACKS, or something like that) or what documents I can check to understand the concept better.

Greetings.

[Jennifer Halim]

Which device are you referring to? ASA firewall? IOS router? IPS?

[iec1128759]

it´s about IOS Router with IPS

[Jennifer Halim]

Here is the list of supported TCP signatures for IOS IPS:

http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_cfg_ips_external_docbase_0900e4b180de56d7_4container_external_docbase_0900e4b180e076b5.html#wp1164830

Atomic.TCP: signature# 3038-3043

OTHER (SYN attack signatures): signature# 3050

STRING.TCP: signature# 3150-3152

You can check each of the above signature individual via:

http://tools.cisco.com/security/center/search.x

And here is the TCP out of order packet inspection for your reference:

http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_out_order_fwall_ps6350_TSD_Products_Configuration_Guide_Chapter.html

Hope that helps.