Cisco Security Center; Ips-Supplied Signature Definition Files - Cisco ROUTER-SDM-CD User Manual

Chapter 27 Cisco IOS IPS

Cisco Security Center

IPS-Supplied Signature Definition Files

Note
Determine Which SDF File Is in Memory
OL-4015-12
The Cisco Security Center provides information on emerging threats, and links to
the Cisco IOS IPS signatures available to protect your network from them.
Signature reports and downloads are available at this link (requires login):
http://tools.cisco.com/MySDN/Intelligence/searchSignatures.x
To ensure that the router has as many signatures available as its memory can
accommodate, Cisco SDM is shipped with one of the following SDFs:
• 256MB.sdf—If the amount of RAM available is greater than 256 MB. The
256MB.sdf file contains 500 signatures.
128MB.sdf—If the amount of RAM available is between 128 MB and
•
256 MB. The 128MB.sdf file contains 300 signatures.
attack-drop.sdf—If the amount of available RAM is 127 MB or less. The
•
attack-drop.sdf file contains 82 signatures.
If your router runs Cisco IOS version 12.4(11)T or later, you must use an SDF file
that has a name of the format sigv5-SDM-Sxxx.zip; for example,
sigv5-SDM-S260.zip.
The router must be running Cisco IOS Release 12.3(14)T or later releases to be
able to use all the available signature engines in 256MB.sdf and 128MB.sdf files.
If the router uses an earlier release, not all signature engines will be available.
To use an SDF in router memory, determine which SDF has been installed and
then configure Cisco IOS IPS to use it. The procedures that follow show you how
to do this.
To determine which SDF file is in router memory, open a Telnet session to the
router, and enter the show flash command. The output will be similar to the
following:
System flash directory:
Cisco Router and Security Device Manager 2.5 User's Guide
Edit IPS
27-55