6.1	Understanding Signatures
		6.1.5	Signature series and categories
CIDS organizes its signatures in series. Each series is a collection of related signatures. There signature series are: 1000, 2000, 3000, 4000, 5000, 6000, 8000, and 10000. The following is a list of the series and the signatures found within each: 1000 Series—IP signatures IP Options IP Fragmentation Bad IP Packets 2000 Series—ICMP signatures ICMP Traffic Records Ping Sweeps ICMP Attacks 3000 Series—TCP signatures TCP Traffic Records TCP Port Scans TCP Host Sweeps Mail Attacks FTP Attacks Legacy CIDS Web Attacks (Signature IDs 3200-3233) NetBIOS Attacks SYN Flood and TCP Hijack Attacks TCP Applications 4000 Series—UDP signatures UDP Traffic Records UDP Port Scan UDP Attacks UDP Applications 5000 Series—Web (HTTP) signatures Web Attacks 6000 Series-Cross-Protocol signatures DNS Attacks RPC services Attacks Authentication Failures Loki Attacks Distributed DoS Attacks 8000 Series—String Match signatures Custom String Matches TCP Applications 10000 Series—ACL Policy Violation signatures Defined IOS ACL violations