| 5.1 |  | IOS Firewall IDS |
| 5.1.2 |  | Signature implementations |

| There are some issues to consider before implementing Cisco IOS Firewall IDS, such as :

- Memory usage and performance impact - The performance impact of intrusion detection will depend on the number of signatures enabled, the level of traffic on the router, the router platform, and other individual features enabled on the router such as encryption and source route bridging. The IDS process in the router sits directly in the packet path and searches each packet for signature matches. In some cases, the entire packet needs to be searched. The router must maintain state information and even application state and awareness.
- Signature coverage - The Cisco IOS Firewall IDS identifies 100 of the most common attacks using signatures to detect patterns of misuse in network traffic. The intrusion detection signatures were chosen from a broad cross-section of intrusion detection signatures. The signatures represent severe breaches of security and the most common network attacks and information gathering scans. The dedicated Cisco Secure IDS Sensor appliance audits over 300 signatures, providing more comprehensive coverage on network attacks.

Atomic signatures are those that trigger on a single packet . There is no traffic-dependent memory requirement for auditing atomic signatures. Compound signatures are those that trigger on multiple packets. For auditing compound signatures, IOS Firewall IDS allocates memory to maintain the state of each session for each connection. Memory is also allocated for the configuration database and for internal caching.

Cisco IOS IDS utilizes signatures to detect patterns of misuse in the network. Signatures are classified by both severity and complexity:

- Severity

- Informational signatures - detect information such as a port sweep.
- Attack signatures - detect malicious activity such as illegal ftp commands and Denial of Service (DoS) attempts.

- Complexity

- Atomic signatures - detect simple patterns such as an attempt on a specific host or within a single packet.
- Compound signatures - detect complex patterns such as an attack on multiple hosts or over extended time periods with multiple packets.

| Web Links Data Sheet - Cisco IOS Intrusion Detection Systems Signature List http://www.cisco.com/en/US/products/ sw/secursw/ps2113/products _data_sheet09186a008014c532.html