signature path updates?

darin.marais · ‎09-29-2003

If a sensors is at version of 3.1(4) S52 and the signature up of 3.1(4) S54 is used immediately without first applying 3.1(4) S53, will the patch/signature tuning that is included in 3.1(4) S53 for "Samba call_trans2open Overflow" be applied

TUNED SIGNATURES / RESOLVED CAVEATS

- 3325 Samba call_trans2open Overflow

Refer to DDTS CSCec34170

scoclayton · ‎09-29-2003

Yes, sig updates are cumulative. Meaning, the S54 update will have all of the sigs added in S53. The only time you need to step through a systematic upgrade is when adding new service packs (the number inside the () changes). Service pack updates are not cumulative per se. You can usually tell this by looking at the file size for the updates. The service pack updates are going to be substantially bigger than the sig updates. Hope this helps.

Scott

a.arndt · ‎09-29-2003

Just to amplify a bit, if you were building a new sensor today, you would need to do the following to be up-to-date:

1) Restore CD puts the sensor to 3.1(3)S37;

2) Patch file IDSk9-sp-3.1-4-S50.bin puts the sensor to 3.1(4)S50; and,

3) Patch file IDS-sig-3.4-4-S54.bin puts the sensor to 3.1(4)S54 (latest and greatest for 3.1).

Alex Arndt