topic S262 in Network Security

S262

t-heeter — Sun, 10 Mar 2019 10:22:57 GMT

Anyone running signature update S262 yet? I was wondering why the .pkg file is 8.5 MB when previous updates were about 400KB.

As a side note, IPS version 6 is now listed as coming soon.

Re: S262

attmidsteam — Tue, 19 Dec 2006 17:15:43 GMT

S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.

Re: S262

t-heeter — Tue, 19 Dec 2006 18:30:14 GMT

Glad I didn't install it then...thanks for the info.

Re: S262

attmidsteam — Tue, 19 Dec 2006 21:11:24 GMT

FYI, S263 is supposed to be out now. I've tested it on a couple of sensors now and did not have the crashes as with S262.

Re: S262

scothrel — Wed, 20 Dec 2006 19:26:29 GMT

S262(and later updates..) are large for two reasons. We did ship some engine updates to add two new engines and enhance a third significantly. These updates bring IPS 5.1's engine capability in line with IPS 6.0. See the readme in S263 for new signatures added with the engines. The engine that was enchanced is Engine.Generic...it now has regular expression capability.

The second major cause of the file size bloat is the fact that every signature has been touched to add two new fields, Vulnerable OS and Mars Category. The updates note the deltas between signature levels, and touching every signature makes for a *large* delta.

There are plans to re-baseline the signature set in the future and absorb the large delta in to the base config. This will bring the update file size back down.