OpenSignatures syntax

The Network IPS appliance supports these syntax options for custom OpenSignatures rules.

Important: OpenSignatures require the content keyword to function properly. If the OpenSignature rule is improperly formatted, you might receive a PAM configuration error response.
Table 1. OpenSignatures syntax
Options Syntax
<action> alert
<protocol> tcp, udp, icmp, icmpv6, ip
<IP and netmask>
  • single IP address (a.b.c.d)
  • range of IP addresses (a.b.c.d-w.x.y.z)
  • network address using CIDR notation (a.b.c.0/24)
The negation operator !
Example: alert tcp !192.168.1.0/24 This option means that an alert prompts you when anything other than what is indicated with the '!' is used.