I'm tryng to build a customized signature on Cisco IPS 5.1 so it can detect an specific content-type in http header. I did my research and found that i should use an http inspection engine built in Cisco IPS and a command called regex. An example of this would be very helpful.
Thanks ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
