ccna 4-8

ccna 4-8.The K;degree of the horizon for each feature is different. . An IPS cannot maintain state information indefinitely. information, otherwise it will eventually run out of resources. Therefore, when the initial feature components are detected, the IPS uses the configured horizon to determine how long it will take to find a particular attack feature.Note: The terms "atom" and "combination" are similar to the terms "atom" and "compound" used in chemistry.5.2.1.3 Feature files5.2 IPS Features 127 Network security threats occur very frequently and spread very quickly. Once a new threat is identified, a new feature must be created and uploaded to the IPS. to make this process easier, all features are contained in a feature file and uploaded to the IPS on a regular basis. The feature file packages the network features together and updates them to the feature database located on the Cisco product that has IPS or IDS capabilities. The IPS or IDS solution uses the feature database to compare network traffic with the data samples in the feature file library. The IPS or IDS uses this comparison to detect suspicious malicious network traffic behavior. For example, LAND attacks are identified by the "Impossible IP Packet" feature (Feature 1102.0). The feature file contains this and many other features. Networks that deploy the latest feature files are better able to prevent network intrusions. Once a VeriSign SSL certificate is installed on an ISRG2 device, the device can be configured to automatically obtain IPS feature updates from Cisco.com on a regular basis. Note: Although the 1INS certification exam covers the CiscoIPS4220 series, this series of devices has been replaced by the CiscoIPS4300 series of devices.5.2.1.4 Feature MicroengineTo make feature scanning more efficient, Cisco IOS software relies on the Feature Micro Engine (SME), which is used to group common features into groups. Cisco IOS software can scan multiple features based on group features (rather than one feature at a time).When IDS or IPS is enabled, the SME is loaded or built on the router. When the SME is built, the router may need to compile the regular expressions found in the feature. A regular expression is a systematic way to specify a byte sequence pattern to search for.The SME then looks for malicious behavior in specific protocols. Each engine defines a set of legal parameters or a set of values with allowed ranges for the protocols and fields it detects. The microengines scan atomic and combinatorial packets to identify the protocols within the packets. Features can be defined using parameters provided by the SME.Each SME extracts values from the packet and passes a portion of the packet to the regular expression engine. The regular expression engine can look for multiple patterns at the same time.The available SMEs vary by platform, CiscoIOS version, and feature file version. CiscoIOS defines 5 microengines.