cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
268
Views
0
Helpful
2
Replies

Uninstalling Signatures

fregon
Level 1
Level 1

Hello,

I'm trying to install the latest signature update IDS-sig-3.1-3-S42.bin. But on the release notes it stats that the update can only be performed on version 3.1(3)S31. I have downgraded the sensor to version 3.1(3)S33 but I can not uninstall any more. I have tried to install previous versions of service packs but unsuccesful. Any ideas?????

Thank you

2 Replies 2

marcabal
Cisco Employee
Cisco Employee

The Readme isn't clear enough.

The Readme should have read (the S43 readme will read):

The 3.1(3)S31 service pack must be installed prior to installing the

signature update. The sensor will report a version of 3.1(3)S31 or

higher if the service pack has been installed. You can determine the

current sensor version by logging into the sensor as netrangr and typing

the following command:

idsvers

The applicable sentence is "The sensor will report a version of 3.1(3)S31 or

higher if the service pack has been installed. "

In you case 3.1(3)S33 fits the "or higher" part of the sentence. Some time in the past you loaded 3.1(3)S31 Service Pack and later loaded the S33 Signature Update. All that matters is that you have already loaded the 3.1(3)S31 Service Pack it doesn't matter that you loaded any signature update (like S33) after it. You can still directly install the 3.1(3)S42 update without having to do any uninstallations or re-installations.

A little comment on versions:

If you see a version 3.1(3)S43 there are 4 version levels that you need to be aware of.

The first 3 represents the MAJOR version level.

The 1 represents the MINOR version level.

The 3 in parentheses represents the SERVICE PACK level.

The S43 represents the SIGNATURE level.

When installing a Signature Update here are the 2 things that have to be true for you to be able to install the file:

1) The Signature level (S43) has to Higher than what is already on your sensor ( S43 > S33 in your case so that is OK).

and

2) The Major.Minor(ServicePack) portion [ 3.1(3)] of the update must match exactly what is on your sensor ( 3.1(3) == 3.1(3) in your case so this is OK as well).

So as long as these 2 things are true (as they are in your case) then you can install the signature update.

Thank you for your reply!

I actually loaded S43 on top of S33 without a problem, I was just concerned because the readme file specifically stated that you must have 3.1(3)S31 installed and that you should either upgrade to or downgrade to that specific version.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: