Hi,
Cisco devices use signature-based technology to detect network intrusions(attacks).
These signatures detect the network intrusion type with the help of its Sensors as they scans network packets while scanning packets they uses their signatures to detect the intrusion type like: denail-of-service attack (DoS).
The Sensor works like virus checking programs. The IPS carries a set of different signatures that sensor uses to with network activity. when a match is found, the sensor will take necessary action like logging or as defined in policies.
We can also modify the signatures according to our need.
To configure a sensor to monitor traffic for a particular signature, you must enable the signature. By default the most critical signatures are enabled. when an attack is detected that matches an enabled signature, the sensor generates an alert.
Cisco IPS contains 10,000 in-built signatures which you can not edit or delete.
Regards,
Rahul Chhabra
Network Engineer
Spooster IT Services
