Re: [Help] Cisco IDS stopped after the update

Do you have logging turned on? I have noticed that when the logging buffer gets full...the IDS likes to quit responding. If you d/l all the logs, that seems to clear it up.

Aaron

----- Original Message ----- From: "ahmad mubarak" <gosi.infosec@xxxxxxxxx>
To: <security-basics@xxxxxxxxxxxxxxxxx>
Sent: Saturday, June 17, 2006 2:03 AM
Subject: [Help] Cisco IDS stopped after the update


hi all

we have 4 Cisco IDSs (4250,4235), after i updated them with the latest
signature

IDS-sig-4.1-5-S229.rpm.pkg

one of them which consideres as the most important stopped and never generate

any event , i rebooted the system and enabled all signatures >> and nothing

happened. please help me to get over this problem ?

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email ______________________________________________________________________


Relevant Pages

  • RE: MS Exchange
    ... You can apply policies for instance only applies signature ... It needs to black the user from making changes to the sig / disclaimer. ... This email has been scanned by the MessageLabs Email Security System. ...
    (Focus-Microsoft)
  • Re: Zone Alarm versus Sygate
    ... Not only is BlackIce looking at ... You see an attack will not ... IDS engine to be extremely elementary. ... So Sygate as well as BlackIce use a Signature Analysis IDS engine ...
    (comp.security.firewalls)
  • Re: How to choose an IDS/FW MSS provider
    ... What is the best way to evade an IDS? ... Open sigs for an IDS/IPS does more harm then good IMO. ... IE a SKILLED attacker wants to attack my network, ... what is out there, a closed signature set, and the ABILITY to add your ...
    (Focus-IDS)
  • RE: Best Method(s) for signature verifcation.
    ... if the IDS is trying to be "smart" it may not listen on ports ... listening in order to get the IDS to see an attack. ... > Subject: Re: Best Methodfor signature verifcation. ... > false positives ...
    (Focus-IDS)
  • RE: How to choose an IDS/FW MSS provider
    ... Andrew, I can't completely agree with you. ... their IDS - may be this is the reason for thinking that great amount FPs is ... to admin to do something or not. ... Thus my point - while seeing the details of a signature is fascinating ...
    (Focus-IDS)