- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2006 07:05 AM - edited 03-10-2019 03:22 AM
Anyone running signature update S262 yet? I was wondering why the .pkg file is 8.5 MB when previous updates were about 400KB.
As a side note, IPS version 6 is now listed as coming soon.
Solved! Go to Solution.
- Labels:
-
IPS and IDS
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2006 09:15 AM
S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2006 09:15 AM
S262 is larger because it included engine updates and I think it should have been categorized as a service pack. Regardless, it crashed on a test sensor here so S263 is supposed to be released later today. I wouldn't be surprised to see S262 yanked due to its issues.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2006 10:30 AM
Glad I didn't install it then...thanks for the info.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2006 01:11 PM
FYI, S263 is supposed to be out now. I've tested it on a couple of sensors now and did not have the crashes as with S262.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-20-2006 11:26 AM
S262(and later updates..) are large for two reasons. We did ship some engine updates to add two new engines and enhance a third significantly. These updates bring IPS 5.1's engine capability in line with IPS 6.0. See the readme in S263 for new signatures added with the engines. The engine that was enchanced is Engine.Generic...it now has regular expression capability.
The second major cause of the file size bloat is the fact that every signature has been touched to add two new fields, Vulnerable OS and Mars Category. The updates note the deltas between signature levels, and touching every signature makes for a *large* delta.
There are plans to re-baseline the signature set in the future and absorb the large delta in to the base config. This will bring the update file size back down.
