Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

S262

Anyone running signature update S262 yet? I was wondering why the .pkg file is 8.5 MB when previous updates were about 400KB.

As a side note, IPS version 6 is now listed as coming soon.

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: S262

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

4 REPLIES
Silver

Re: S262

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

Community Member

Re: S262

Glad I didn't install it then...thanks for the info.

Silver

Re: S262

FYI, S263 is supposed to be out now. I've tested it on a couple of sensors now and did not have the crashes as with S262.

Cisco Employee

Re: S262

S262(and later updates..) are large for two reasons. We did ship some engine updates to add two new engines and enhance a third significantly. These updates bring IPS 5.1's engine capability in line with IPS 6.0. See the readme in S263 for new signatures added with the engines. The engine that was enchanced is Engine.Generic...it now has regular expression capability.

The second major cause of the file size bloat is the fact that every signature has been touched to add two new fields, Vulnerable OS and Mars Category. The updates note the deltas between signature levels, and touching every signature makes for a *large* delta.

There are plans to re-baseline the signature set in the future and absorb the large delta in to the base config. This will bring the update file size back down.

172
Views
0
Helpful
4
Replies
CreatePlease to create content