Introduction
This document describes how to check what are changes in the signature behavior that have been made when a new signature pack has been updated on the IPS in additon to the new signatures that are introduced.
Problem
Most of the times, customers report issues with the traffic flows being impacted/specific application observing packet drops after signature update has been performed on the IPS. So the key for troubleshooting such issues would be to understand what are changes that are made to the active signature set after the signature update process completed.
Solution
Step 1 :
The first thing that we need to check is the upgrade history for the signature. This would tell us the previous signature pack that was running on IPS and the current version of signature pack.
This can be found out from the output of the command "show version" or from the upgrade history section of the "show tech". Snippet from the same is mentioned below:
Upgrade History:
* IPS-sig-S733-req-E4 19:59:50 UTC Fri Aug 09 2013
IPS-sig-S734-req-E4.pkg 19:59:49 UTC Tue Aug 13 2013
Now from the above we can make out that the previous signature pack that was running on the IPS was s733 and has been upgraded to s734 which is current signature pack.
Step 2 :
The second step is to understand the changes that have been made which can be checked through the IME/IDM. Screenshots of how to check the same has been shown below:
ScreenShot1 : Displays the active signature tab on the IME/IDM:
ScreenShot2 : Displays how to select a specific signature release:
Further using the filter option once we have obtained all the signatures from a particular release we can filter them based on engine, fidelity, severity etc.
By this we would be able to narrow down on the changes in signature release which can be potential cause for the issue based on which we can align our troubleshooting.