I've been scouring for documentation regarding byte pattern recognition on Cisco ASA's, and I've been unable to find anything. I've been tasking with converting a Snort rule into an ASA security object. The snort rule is a simple byte pattern. My question...

Are Cisco ASA's capable of identifying byte patterns in TCP packets?

I'd like to identify a pattern such as the following in TCP packets passing through the ASA:

6E; depth:1; 36 36 36 58 36 36 36; offset:3; depth:7;

I appreciate any assistance. Thank you!

1 Answer 1


Yes but you will need the IPS module on your ASA. Then you can define a custom signature with the info from your snort rule.

Alternatively, if you don't have the IPS module and if using snort is an option, you could use Snortsam to trigger a block in your ASA config when snort detects a threat.

  • We have the IPS module. Can this be set up through the CLI or does it require ASDM? The links are very helpful thank you. They mention plenty of values/tables to choose from but mention of actual commands is scarce Is anyone already familiar with the command syntax for this if it can be done through the CLI? Thanks
    – Rumblebutt
    Aug 23, 2014 at 2:09
  • I've only seen ASDM settings for this. I'll double check a couple of my books tomorrow to see if there are CLI commands to configure this. Also the last section of the first link gives specific examples for converting snort rules. Though no commands are mentioned. I blew away the IPS module on my own ASA for the CX module so I cannot test it out myself. Aug 23, 2014 at 2:13
  • All of my books are for the ASA and only briefly touch on the IPS module. Their only references to the CLI are for configuring the management of the IPS module. However you can find a CLI guide at cisco.com/c/en/us/td/docs/security/ips/7-1/configuration/guide/… which has chapters for the different ASA modules (depending on your ASA model). Aug 23, 2014 at 14:54
  • You've been a great help! I'll have to check out the ASDM settings and links in-depth on monday.
    – Rumblebutt
    Aug 24, 2014 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.