Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Mars - IPS Signature Updates

I noticed my MARS box is at signature level 358 released in mid Sept. I am using auto updates. The latest IPS signature release is 361. Any ideas why there is a delay for MARS to support the new signatures?

Mars is roughly a month behind. I don't check Mars' signature status regularly, so this could be the norm.

9 REPLIES

Re: Mars - IPS Signature Updates

I had been checking one of our boxes quite frequently since the past few months and it almost always updated within 1-2 days of the signature release (IPS).

However I just checked now after looking at your post, and ours was also stuck at 358! I did a manual "Update Now" and it took me to:

Download Succeeded: CS-MARS downloaded IPS Signature file - IPS-CS-MARS-Sig-S360.zip

at Oct 21, 2008 08:34:16 AM

I wonder what is causing this.

Regards

Farrukh

New Member

Re: Mars - IPS Signature Updates

Interesting. Sometime between my post and your post, MARS IPS S360 and S359 were posted. I guess the Cisco MARS team is a little behind.

Re: Mars - IPS Signature Updates

Yup you are right, they were both release on oct 20:

http://www.cisco.com/cgi-bin/tablebuild.pl/mars-ips-sigup

It seems the XML is broken from Cisco, if I put the MARS update URL in the browser I get:

https://www.cisco.com/cgi-bin/ida/locator/locator.pl

-

-

001

2008/10/21/5:11:51

Unable to parse inputXML

Whereas previously it would give a URL for the CCO download page AFAIR.

Also after seeing the above URL it seems a gap of 10-15 days between IPS and MARS signature releases is common.

Regards

Farrukh

Cisco Employee

Re: Mars - IPS Signature Updates

Hi,

There was an issue with the process that was to get the XML updates for the signature posted. That has been corrected and the signature updates were posted over the past weekend.

The MARS IPS signature updates should post to CCO approx. 24 hours after new IPS updates post.

Raymond

Re: Mars - IPS Signature Updates

We are facing the same issue again with MARS signature updates, anybody else facing the same issue?

MARS Version: 4.3

GUI Error:

Download Failed: CS-MARS could not download IPS Signature file
at Dec 19, 2009 03:46:13 AM AST

If I manually put the MARS update URL in the browser:

xml version="1.0" encoding="UTF-8" ?>

- <locator>
- <exception>
<status>001status>
<timeStamp>2009/12/18/21:43:25timeStamp>
<message>Unable to parse inputXMLmessage>
exception>
locator>

Regards

Farrukh

New Member

Re: Mars - IPS Signature Updates

We used to get this error as well, until I found this new URL embedded in MARS documentation:

https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl

Works ok for us now.

New Member

Re: Mars - IPS Signature Updates

Excellent, works now

New Member

Re: Mars - IPS Signature Updates

My MARS broke on December 2nd.  I'm using the new URL and I get the same output as farrukh noted.

"This XML file does not appear to have any style information associated with it. The document tree is shown below.
     




001
2010/1/18/7:37:5
Unable to parse inputXML

"

back to manual updates :-(

Re: Mars - IPS Signature Updates

Even tough I kept seeing the same input..parsing errors in the browser for the new link. it worked when I entered it into MARS! However the websites/IPs used by MARS to update the packages from the Cisco website have changed. So if you have a firewall blocking those, you might have to fix that.

Regards

Farrukh

2791
Views
5
Helpful
9
Replies