cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
829
Views
0
Helpful
4
Replies

IDS signature updates

JUSTIN LOUCKS
Level 1
Level 1

This may be an easy question but I am new to the IDS sensors and cannot find an answer to it yet. Are the IDS signature updates that you get all-inclusive or do they need to be applied sequentially?

Thanks,

Justin Loucks

4 Replies 4

hwon
Level 1
Level 1

The IDS signatures are cumulative, and signature 141 will include 140 and below updates. Thus, you don't need to apply signatures sequentially.

The statement that "IDS signatures are cumulative" is, as a whole, is correct. Unfortunately, there is a caveat that should be relayed.

Signature updates are only cumulative back to the last Service Pack release. For example, you can apply S142 update to any applicable Cisco IDS appliance, but only if it is has S91 installed.

From the S142 readme file:

"The IDS-sig-4.1-4-S142.rpm.pkg signature update can be applied to

version 4.1(4) sensors as follows:

You can only apply this signature update to IDS-42xx Cisco Intrusion

Detection System (IDS) sensors, the WS-SVC-IDSM2 series Intrusion

Detection System Module (IDSM2), and the NM-CIDS series Intrusion

Detection Network Module.

It is not compatible with the NRS-xx series Intrusion Detection System

(IDS) sensors or the WS-X6381-IDS series Intrusion Detection System

Module (IDSM).

The sensor must report the version of sensor as 4.1(4)S91 or later

before you can apply this signature update."

Obviously, this means that you'll have to update with the S91 service pack before applying S142 if the sensor is running something older than S91.

The last Recovery/Upgrade CD that I have from Cisco is S47, so it would be necessary for me to upgrade a sensor built with this CD to S91 first before I could apply the "cumulative" S142 signature update.

I hope this helps,

Alex Arndt

This helps very much so. Sorry, I didn't realize that there was a readme file associated but now that you said that, I checked the IDS and see that it does download the signature and a readme file each time. Thanks for the full explanation.

Justin Loucks

Always glad to help out. =)

Alex

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card