Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Help needed to create a custom signature.

Would like to create a custom 3.1 signature to alert on TCP SYN packets with a specific window size of 55808.

I've looked at the TCP SYN.engine but that doesn't give me an option to quantify the window size.

Anyone have any ideas? - Thanks

1 REPLY
Bronze

Re: Help needed to create a custom signature.

Unfortunately, we are unable to search packets based on TCP window size. This has spawned an idea about creating a parameter that will allow arbitrary fields in the TCP header to be searched. This will of course be in a major update in the future. I will file an enhancement request to track this issue.

90
Views
5
Helpful
1
Replies
CreatePlease login to create content