×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

S262

Answered Question
Dec 19th, 2006
User Badges:

Anyone running signature update S262 yet? I was wondering why the .pkg file is 8.5 MB when previous updates were about 400KB.


As a side note, IPS version 6 is now listed as coming soon.

Correct Answer by attmidsteam about 10 years 8 months ago

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
attmidsteam Tue, 12/19/2006 - 09:15
User Badges:
  • Silver, 250 points or more

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

t-heeter Tue, 12/19/2006 - 10:30
User Badges:

Glad I didn't install it then...thanks for the info.

attmidsteam Tue, 12/19/2006 - 13:11
User Badges:
  • Silver, 250 points or more

FYI, S263 is supposed to be out now. I've tested it on a couple of sensors now and did not have the crashes as with S262.

scothrel Wed, 12/20/2006 - 11:26
User Badges:
  • Cisco Employee,

S262(and later updates..) are large for two reasons. We did ship some engine updates to add two new engines and enhance a third significantly. These updates bring IPS 5.1's engine capability in line with IPS 6.0. See the readme in S263 for new signatures added with the engines. The engine that was enchanced is Engine.Generic...it now has regular expression capability.

The second major cause of the file size bloat is the fact that every signature has been touched to add two new fields, Vulnerable OS and Mars Category. The updates note the deltas between signature levels, and touching every signature makes for a *large* delta.


There are plans to re-baseline the signature set in the future and absorb the large delta in to the base config. This will bring the update file size back down.



Actions

This Discussion