I just did the sig update for 3.1(2)S27 on my 4230 sensor. It doesn't appear that the NSDB on the sensor itself was updated, i.e., the signatures that the IDM points to when managing the signatures on the sensor. Newer signatures are not listed, an...

Upgraded to IDS 3.1 today, seems to have gone well, except I'm trying to use the new cidserver (IDM) feature. ps -ef shows it's running, I can start it but not stop it (cidServer start works but cidServer stop doesn't kill the server, (apparently be...

Sig 3161 (MKD overflow) triggered for one of my customers when he was replacing some cgi scripts. From NSDB:This signature triggers when an attempt is detected to create or delete a directory during a FTP session using a path argument containing exe...

I have a customer repeatedly triggering 6302 Modified Loki while monitoring his server at our facility from his remote location. He claims he is using only IPSentry and a standard ICMP ping to do his monitoring. This would appear completely unrelat...

When I get this message, I am assuming there is a limit to how many IPs can be blocked in the deny ACL applied to the routers. Is this a hard limit, or can I change it? If so, where? Are there any potential hazards to raising this limit? I don't ...