Mars - IPS Signature Updates

rmeans · ‎10-20-2008

I noticed my MARS box is at signature level 358 released in mid Sept. I am using auto updates. The latest IPS signature release is 361. Any ideas why there is a delay for MARS to support the new signatures?

Mars is roughly a month behind. I don't check Mars' signature status regularly, so this could be the norm.

Farrukh Haroon · ‎10-20-2008

I had been checking one of our boxes quite frequently since the past few months and it almost always updated within 1-2 days of the signature release (IPS).

However I just checked now after looking at your post, and ours was also stuck at 358! I did a manual "Update Now" and it took me to:

Download Succeeded: CS-MARS downloaded IPS Signature file - IPS-CS-MARS-Sig-S360.zip

at Oct 21, 2008 08:34:16 AM

I wonder what is causing this.

Regards

Farrukh

rmeans · ‎10-21-2008

Interesting. Sometime between my post and your post, MARS IPS S360 and S359 were posted. I guess the Cisco MARS team is a little behind.

Farrukh Haroon · ‎10-21-2008

Yup you are right, they were both release on oct 20:

http://www.cisco.com/cgi-bin/tablebuild.pl/mars-ips-sigup

It seems the XML is broken from Cisco, if I put the MARS update URL in the browser I get:

https://www.cisco.com/cgi-bin/ida/locator/locator.pl

-

001

2008/10/21/5:11:51

Unable to parse inputXML

Whereas previously it would give a URL for the CCO download page AFAIR.

Also after seeing the above URL it seems a gap of 10-15 days between IPS and MARS signature releases is common.

Regards

Farrukh

rajett · ‎10-29-2008

Hi,

There was an issue with the process that was to get the XML updates for the signature posted. That has been corrected and the signature updates were posted over the past weekend.

The MARS IPS signature updates should post to CCO approx. 24 hours after new IPS updates post.

Raymond

Farrukh Haroon · ‎12-18-2009

We are facing the same issue again with MARS signature updates, anybody else facing the same issue?

MARS Version: 4.3

GUI Error:

Download Failed: CS-MARS could not download IPS Signature file
at Dec 19, 2009 03:46:13 AM AST

If I manually put the MARS update URL in the browser:

xml version="1.0" encoding="UTF-8" ?>

- <locator>

- <exception>

<status>001status>

<timeStamp>2009/12/18/21:43:25timeStamp>

<message>Unable to parse inputXMLmessage>

exception>

locator>

Regards

Farrukh

mohammad.sayeed · ‎01-11-2010

We used to get this error as well, until I found this new URL embedded in MARS documentation:

https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl

Works ok for us now.

yessercco · ‎01-11-2010

Excellent, works now

GrumpyBear · ‎01-18-2010

My MARS broke on December 2nd. I'm using the new URL and I get the same output as farrukh noted.

"This XML file does not appear to have any style information associated with it. The document tree is shown below.

−

−

001
2010/1/18/7:37:5
Unable to parse inputXML

"

back to manual updates :-(

Farrukh Haroon · ‎01-18-2010

Even tough I kept seeing the same input..parsing errors in the browser for the new link. it worked when I entered it into MARS! However the websites/IPs used by MARS to update the packages from the Cisco website have changed. So if you have a firewall blocking those, you might have to fix that.

Regards

Farrukh