Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Error in upgrading 4.1 (1) S47 sensors

Hopefully someone can shed some light on what I am doing wrong as this is getting %^$R&$ frustrating

I have both a Cisco 4230 and 4210 sensor which I have upgraded to 4.1 (1) S47 from version 3 using the Cisco provided Recovery/Upgrade CD. The 4210 has the additional 256Mb of RAM for a total of 512Mb.

Once upgraded to 4.1 (1) S47 I then attempted to apply 4.1 (3) S61 with no luck - the file would appear to download, the sensor would restart but the version always appeared as 4.1 (1) S47

Thinking that an earlier SP may be required I downloaded 4.1 (2) S58 and tried to upgrade both sensors via CLI and Web interface - downloads the file from FTP, reboots but still 4.1 (1) S47

FTP server is SERV-U V5 - logs show sensor downloading file correctly

This is the info from the Telnet session

au-sydidss001# config term

au-sydidss001(config)# upgrade ftp://dhale@


Password: *********

Warning: Executing this command will apply a service pack to the application par

tition. The system may be rebooted to complete the upgrade.

Continue with upgrade? : yes

Broadcast message from root (Wed Apr 7 04:25:02 2004):

Applying update IDS-K9-sp-4.1-2-S58.

Shutting down all CIDS processes. All connections will be terminated.

The system will be rebooted upon completion of the update.

Connection to host lost.


After the sensor has restarted - checking the Version show the following;

au-sydidss001# show ver

Application Partition:

Cisco Systems Intrusion Detection Sensor, Version 4.1(1)S47

OS Version 2.4.18-5smpbigphys

Platform: IDS-4230

Sensor up-time is 7 min.

Using 243843072 out of 492691456 bytes of available memory (49% usage)

Using 570M out of 7.8G bytes of available disk space (8% usage)

MainApp 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


AnalysisEngine 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


Authentication 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


Logger 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


NetworkAccess 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


TransactionSource 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


WebServer 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500 R


CLI 2003_Jun_20_06.00 (Release) 2003-06-20T05:53:31-0500

Upgrade History:

No upgrades installed

Recovery Partition Version 1.2 - 4.1(1)S47

This is the same on both sensors

If anyone has any ideas on what is the problem or hints on troubleshooting it would be greatly appreciated


Cisco Employee

Re: Error in upgrading 4.1 (1) S47 sensors

Look at the output of show tech support (even easier to read is the diagnostics run from with in IDM since it will be html formatted and contain the same information).

If I remember correctly there will be an area that pulls information from logs that are made during the update. You could check these logs for any possible errors.

From your posting there is one thing that does pop out. In the command: upgrade ftp://dhale@


All of the letters are lower case. This will cause problems. The sensor is a Linux OS and does treat capital letters differently than lower case letters (unlike Windows).

The sensor is probably detecting that the file has been renamed, and is unable to properly execute it.

What to do: Be sure the filename on your FTP has the exact name (including capitalization) for the file as it is listed on CCO. Be sure to use this exact name (including capitalization) when executing the upgrade command.


Re: Error in upgrading 4.1 (1) S47 sensors


Thanks for the rapid response

Just tried on the 4230 using the case sensitive file name and success - I will try the 4210 and the later files but it looks pretty good so far

Thanks for your valued assistance with this - will advise if there are any other issues with the other updates (and the hair I will now not rip out of my head thanks you as well!)


New Member

Re: Error in upgrading 4.1 (1) S47 sensors

We too have had this problem. Turns out it is a connection timeout issue. SP61 is so large that the scp session times out before completion. Try manually updating the sensor without using the IDS-MC.

It worked for us!

CreatePlease to create content