IPS V6.06E4 Error

[learnsec]

Dear all,

An error appeared on the IPS Log mentioning the following:

   " SignatureDB: TcpRootNode non-zero refcount (1st pass) - exit destructor "

Knowing that the IPS did not face any reload, it is up from more than 3 months.

Is that an indication for anything severe?

Any recommendation?

regards,

[Jennifer Halim]

Looks like the error message that you are getting matches this bug: CSCtj78015:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtj78015

Upgrade to 7.0.5(E4) will resolve the issue.

[learnsec]

thanks for your reply,

but the bug indicates the following condition:

Conditions:

Currently only seen on NME-IPS sensors. May be limited to MIPS based sensors (AIM,NME).

Which is not my case, it is not an NME IPS, it is a normal Physical IPS "IDS-4215-K9".

What do you think?

[Jennifer Halim · Accepted solution]

It might be on the IDS-4215 platform as well. The bug was reported on NME module, hence the bug notes seem to imply it is only affected on NME module.

In any case, you might want to look at replacing the IDS-4215 as it's already EOL:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/ps5367/end_of_life_notice_for_cisco_ids_4215_sensor.html

and the last engineering release on IDS-4215 was July 29, 2009.