Cisco Cisco Firepower Management Center 4000
32-67
FireSIGHT System User Guide
Chapter 32 Understanding and Writing Intrusion Rules
Understanding Keywords and Arguments in Rules
The following table lists the values and strings recognized by the system for each GTP information
element.
element.
Table 32-41
GTP Information Elements
Value
Version 0
Version 1
Version 2
1
cause
cause
imsi
2
imsi
imsi
cause
3
rai
rai
recovery
4
tlli
tlli
N/A
5
p_tmsi
p_tmsi
N/A
6
qos
N/A
N/A
8
recording_required
recording_required
N/A
9
authentication
authentication
N/A
11
map_cause
map_cause
N/A
12
p_tmsi_sig
p_tmsi_sig
N/A
13
ms_validated
ms_validated
N/A
14
recovery
recovery
N/A
15
selection_mode
selection_mode
N/A
16
flow_label_data_1
teid_1
N/A
17
flow_label_signalling
teid_control
N/A
18
flow_label_data_2
teid_2
N/A
19
ms_unreachable
teardown_ind
N/A
20
N/A
nsapi
N/A
21
N/A
ranap
N/A
22
N/A
rab_context
N/A
23
N/A
radio_priority_sms
N/A
24
N/A
radio_priority
N/A
25
N/A
packet_flow_id
N/A
26
N/A
charging_char
N/A
27
N/A
trace_ref
N/A
28
N/A
trace_type
N/A
29
N/A
ms_unreachable
N/A
71
N/A
N/A
apn
72
N/A
N/A
ambr
73
N/A
N/A
ebi
74
N/A
N/A
ip_addr
75
N/A
N/A
mei
76
N/A
N/A
msisdn
77
N/A
N/A
indication