Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Signature to compare data

Hi folks

I got a question today that left we thinking and no answer.

Can I, on an IPS 7.x, create a rule that compares data in a HTTP flow?

Example: User send a login request in clear text but the server responds with a different account. A custom packet sniffer app would store the data, extract the login, store it as a variable and then compare it with the response. Easy, but can the IPS do that?

Regards

Fredrik

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Signature to compare data

Fredrik;

  No, the IPS is not designed to store values for later comparison - it only checks the data in the current flow.

Scott

2 REPLIES
Cisco Employee

Re: Signature to compare data

Fredrik;

  No, the IPS is not designed to store values for later comparison - it only checks the data in the current flow.

Scott

New Member

Re: Signature to compare data

Plain and simple, as I suspected. Thank you.

Regards

Fredrik

209
Views
0
Helpful
2
Replies
CreatePlease to create content