S262

[t-heeter]

Anyone running signature update S262 yet? I was wondering why the .pkg file is 8.5 MB when previous updates were about 400KB.

As a side note, IPS version 6 is now listed as coming soon.

[attmidsteam · Accepted solution]

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

[t-heeter]

Glad I didn't install it then...thanks for the info.

[attmidsteam]

FYI, S263 is supposed to be out now. I've tested it on a couple of sensors now and did not have the crashes as with S262.

[scothrel]

S262(and later updates..) are large for two reasons. We did ship some engine updates to add two new engines and enhance a third significantly. These updates bring IPS 5.1's engine capability in line with IPS 6.0. See the readme in S263 for new signatures added with the engines. The engine that was enchanced is Engine.Generic...it now has regular expression capability.

The second major cause of the file size bloat is the fact that every signature has been touched to add two new fields, Vulnerable OS and Mars Category. The updates note the deltas between signature levels, and touching every signature makes for a *large* delta.

There are plans to re-baseline the signature set in the future and absorb the large delta in to the base config. This will bring the update file size back down.