Skip to main content

5.2 Release Notes

The release notes of all 5.2 rWeb and RIOS versions are stored here.

5.2.9sp3 System Release Notes (RIOS 5.2.9sp3, rWeb 5.2.9.release.1)​

RIOS 5.2.9sp3 (RE2000, RE4000, RS10, RS30, RG)

Bug Fixes

  • Patch for "Shellshock" vulnerabilities CVE-2014-6271/7169. Additionally, this version of RIOS was tested and not vulnerable to CVE-2014-7187.

rWeb 5.2.9.release.1

Bug Fixes

5.2.9sp2 System Release Notes (RIOS v5.2.9sp2)​

RIOS v5.2.9sp2 (RE2000, RE4000, RS10, RS30, RG)

Bug Fixes

  • Fixed segmentation fault encountered when processing UDP packets with a size less than the UDP header length (8 bytes).
  • Fixed reporting of LLCF and Bypass states.

rWeb (No rWeb upgrade required)

5.2.9sp1 System Release Notes (RIOS v5.2.9sp1)​

RIOS v5.2.9sp1 (RE2000, RE4000, RS10, RS30, RG)

New Features

  • SYN and SYN_ACK packets containing a payload will be dropped. While not explicitly forbidden by RFC, almost all packets of these types are used by attackers and not legitimate hosts. Controls will be enabled for this in a later release. If you know you have good traffic that will be dropped by this mechanism, do not upgrade to 5.2.9sp1 and instead wait for the future release.

Bug Fixes

  • Fix for PVPP and VLAN rules on RG.
  • Fixed a traffic loss condition on transition between Failure and Normal modes.
  • Fixed an issue where TCPDUMP captures dropped traffic while performing a “Good” only capture.
  • Added automatic recovery for a rare SRAM Parity issue on 10G interface cards.
  • Fixed various minor bugs.

Known Issues

  • A failure occurs when there is an ongoing AT22 attack and we receive a UDP packet where the UDP packet length in the UDP header is less than the length of the UDP header itself (nominally 8 bytes). Normally these packets are dropped, however if the zone has the control "Drop invalid length packets:" under "AT62:UDP Protocol Control" disabled (it is enabled by default) then the AT22 payload handler attempts to examine the payload and it segfaults when the length is invalid as described above. The segfault causes the associated filter device to transition to failure mode. We recommend keeping the UDP control "Drop invalid length packets" under AT62 Enabled until this is patched.

rWeb (No rWeb upgrade required)

5.2.9 System Release Notes (RIOS v5.2.9, rWeb 5.2.9.release)​

RIOS v5.2.9 (RE2000, RE4000, RS10, RS30, RG)

New Features

  • AT9 now blocks port scanning and port sweeping behaviors.
  • AT22 functionality extended: blocks NTP attacks, Chargen, and QOTD.

Enhancements

  • Improvements to AT1, AT2 and AT3 algorithms to reduce false positives.
  • AT22 algorithm tuned to reduce false positives and false negatives.

Bug Fixes

  • AT17 fix for broken identical packet check at packet sizes above 300 bytes.
  • 1G driver fix for a condition that prevented the 1G links to become active when looping traffic between 1G data ports.
  • Fix to trigger an automatic reboot of a RioRey device in the rare event of RIOS encountering a Kernel Panic. This fix is mainly relevant to RE devices that would need a manual reboot under this condition.
  • Reduced the log output from the filter algorithms to 1/4th of the output in previous releases. The objective of this fix is to keep historical data for a longer time before it is overwritten.
  • Fix to report correct CPU temperatures in RS30 devices that operate with sensors not supported by some software utilities.
  • 1G driver fix to prevent it from failing to load in RS30 devices without 1G interfaces. This failure does not prevent RS30 devices with no 1G interfaces from operating in previous releases.
  • Fixed various minor bugs.

Known Issues

  • Physically disconnecting and re-connecting a 1G port (on RS30/RE devices) while traffic is flowing may result in a condition where the port remains operationally down. To recover from this condition set the corresponding bypass device into bypass, wait 1 minute, then set it back into normal operation.
  • RIOS devices need to receive NTP data from a server that supports ntpdate. If the server doesn't support this, the device will never leave minimal mode when it is rebooted or first powers on.

rWeb 5.2.9

New Features

Enhancements

  • Default value for AT62 "Drop private IP address packets" changed from True to False.

Bug Fixes

  • Net stat charts fixed to prevent truncation under certain conditions.
  • RG PVPP egress port list fixed to no longer get out of sync with ingress port list under certain conditions.
  • Manual reports no longer hang when the number of victims in the system exceeds 2^32.
  • Fixed API module not starting properly in rare cases.
  • Fixed a problem with the network driver which led to the management interface of an rWeb system hanging in rare cases.
  • Fixed various other minor bugs.

Known Issues

  • Zones with publicly available NTP servers need to make sure they are allowing Version 1 NTP for the servers to respond properly to requests. This is because all normal time requests are currently being interpreted as Version 1, not the version of NTP being used to send the request.

5.2.8 sp 2 System Release Notes (RIOS v5.2.8sp2, rWeb 5.2.8.sp2.release)​

RIOS v5.2.8sp2 (RE2000, RE4000, RS10, RS30, RG)

Enhancements

  • Improvements to data fidelity of 1G driver.
  • Improvements to efficiency of 1G driver.
  • Improved reliability of rWeb commands to RIOS.
  • Improved implementation of link mode on copper interfaces.
  • Improved implementation of LLCF on all supported platforms.

Bug Fixes

  • Various AT62 bug fixes.
  • Fix for tcpdump on RE and RS30 devices with copper interfaces.
  • Fixed various minor bugs.

rWeb 5.2.8sp2

New Features

Enhancements

  • Added Web UI loading screen for slow connections.

Bug Fixes

  • Improved collection of certain invalid packets.
  • Chart refresh bug when viewing a fixed time period.
  • Fixed various minor bugs.

5.2.8 System Release Notes (RIOS v5.2.8, rWeb 5.2.8.release)​

RIOS v5.2.8 (RE2000, RE4000, RS10, RS30, RG)

Enhancements

  • Added support for RE2k, RE4k, RS30s with 1G interfaces.
  • Support added for license management by rWeb.
  • Improved consistency in reporting of traffic in zones.

Bug Fixes

  • Fixed a bug where UDP packets with a packet length of less than the minimum ethernet packet size (implying some padding is present) were incorrectly being reported as AT62.
  • Fixed various minor bugs.

rWeb 5.2.8

New Features

Enhancements

  • Operational status of RBs will be displayed, not just configured state.
  • RE support added.

Bug Fixes

  • Fixed various minor bugs.

5.2.7 sp1 System Release Notes (RIOS v5.2.7sp1)​

RIOS v5.2.7sp1 (RS10, RS30, and RG Supported)

New Features

  • MPLS Support- Devices will now parse all layers of MPLS headers to perform filtering on the innermost Layer 3 IPv4 packets. This applies to L3 MPLS encapsulation only, and not Pseudowire.

Enhancements

  • Expanded Device Support- RS10, RS30, and RG all supported in this release.

5.2.7 System Release Notes (RIOS v5.2.7, rWeb 5.2.7.release)​

RIOS v5.2.7 (RS30 Specific)

New Features

  • RS30 multiple port configuration fully supported.

Enhancements

  • Several performance improvements have been made.

Bug Fixes

  • Improved clock synchronization - will no longer affect RIOS filtering if clocks de-sync. Also, de-sync detection is much more robust.
  • Fixed various minor bugs.

rWeb 5.2.7

New Features

  • AT62 (Invalid Packet) Subtype reporting: AT62 information will now include a 'subtype' which indicates more specifically why RIOS has marked a packet or attacker as invalid.
  • Email notification on attack: It is now possible to configure rWeb to send out an email when a new zone comes under attack (disabled by default).
    • Need to configure an SMTP server first
    • rWeb will send an email when the attack is first detected, so rates and total packet counts may be lower than expected.
    • Thresholds can be configured in the Zone for each attack type to suppress notification for minor attacks.
    • If multiple attacks start at the same time, rWeb will send out one email per zone.
    • Destination email address for the notifications can be configured rweb-wide or on a customer by customer basis.

Bug Fixes

  • Improved clock synchronization - will no longer affect RIOS filtering if clocks de-sync. Also, de-sync detection is much more robust.
  • Handle victim display cleanly when large (1000+) numbers of victims are involved.
  • Fixed some other display issues.
  • Fixed various minor bugs.

5.2.6 System Release Notes (RIOS v5.2.6, rWeb 5.2.6.release)​

New Features

  • Support for new RS30 series of devices.

Enhancements

  • Cleaned up of some outdated and/or unused pieces of interface code

5.2.5 System Release Notes (RIOS v5.2.5, rWeb 5.2.5.release)​

RIOS v5.2.5

Bug Fixes

  • Fixed a bug where rWeb's packet records collected samples of invalid packets at an excessive rate.

rWeb 5.2.5.release

New Features

  • New screen - zone stats, shows zone traffic in a tabular form, accessible through the new "Net Stats" option in the top-level menu.
  • Newly revamped versions of the following screens: administration, device management, customer, and reporting.
  • There is now a status picture for RS devices on the "Device Status" screen.
  • All victim displays, including reports, can now be given thresholds for which attacks to include and not.
  • New report type - Billing

Enhancements

  • Improved naming of pcap files, now include customer and zone in filename.
  • Improved various background cleanup procedures.
  • Searching zones is no longer case sensitive.
  • Chart style improved slightly.
  • Traffic Summary and Zone Stats on the Customer page should now refresh at the same rate.
  • Various logging improvements.
  • Various other minor improvements.

Bug Fixes

  • Expiry time for blacklist should now function properly.
  • Fixed issue causing monthly reports to behave strangely between December and January.
  • RG port traffic table should now behave as expected.
  • Position of date picker could get locked in the bottom left corner of the screen, this has been fixed.
  • Fixed a bug that caused rWeb to freeze when Customers with large amounts of data were deleted in high latency management networks.
  • Fixed sampling of ICMP Type 5 Code 1 packets.
  • Fixed various display issues.
  • Fixed various minor bugs.

5.2.4 sp4 System Release Notes (RIOS 5.2.4sp4, rWeb 5.2.4.release.3)​

RIOS v5.2.4sp4

warning

RIOS 5.2.4sp4 uses the new rWeb 5.2.4.release.3. Please make sure you are running rWeb 5.2.4.release.3 before you upgrade devices to RIOS 5.2.4sp4. NOTE: Upgrading rWeb does not affect connected devices in any way.

Enhancements

  • Temporarily disabled an additional AT62 Invalid Packet constraint that requires UDP packets’ length to matched that reported in their header. This feature was causing issues for some customers. It will be re-enabled and controls for it exposed, in a future release of rWeb/RIOS.
  • Improved packet record data collection to collect more meaningful data when dealing with regex or Layer 7 packets.

Bug Fixes

  • Fixed a bug that allowed the addition of an invalid destination whitelist entry to cause a zone to initialize improperly

rWeb 5.2.4.release.3

Bug Fixes

  • Fixed an issue with secure channel between rWeb and RIOS that would cause connection problems in high-latency environments

5.2.4 sp2 System Release Notes (RIOS 5.2.4sp2, rWeb 5.2.4.release.1)​

RIOS v5.2.4sp2

New Features

  • Added PCAP Functionality to RG.
  • Now allow user-controlled master/standby switchover on RG series.
  • Added support for AT8 attacks.

Enhancements

  • Syslog messages should now include a year in the timestamp.
  • ACK+FIN packets should now be treated as ACK packets for the purposes of Layer 7, improving the filtration of some attacks.
  • Force SYN filtering speed improved.
  • Improved handling of UDP Packets with 0 byte payloads.
  • Improved regex sampling.
  • Adjusted some of the thresholds for EV sensitivities on levels 2, 3, and 4.
  • Improved the data collected for packet samples in non-spoofed attacks, now includes timestamp and layer 2 info.
  • Improved handling of traffic during upgrades, power downs, and reboots – impact to line traffic should be even less now.
  • Added reporting for active/standby for IOM status in the RG series.

Bug Fixes

  • The RG series should now correctly generate packet record data for regex.
  • SYN-ACK floods should now behave properly when seen simultaneous to a SYN flood.
  • ACK with no data packets should now be filtered correctly in all circumstances.
  • NTP status now displays properly for the RG series.
  • Fixed a rare bug that could cause some traffic to be erroneously reported in multiple zones.
  • Fixed some minor issues with synchronizing deletion of data.

rWeb 5.2.4.release.1

New Features

  • Users can now add and delete CA certificates for SMTP servers.
  • Packet record data can now be exported into PCAP files.

Enhancements

  • Minor improvements to customer and zone screen.
  • Graphical improvements to system status screen.
  • Improved rWeb log.

Bug Fixes

  • Fixed a problem that caused the PVPP screen to not update properly.
  • Fixed a number of display bugs.
  • Global filter for API should now function normally.
  • SMTP Servers with Auth type "none" should now save properly.

5.2.4 System Release Notes (RIOS 5.2.4, rWeb 5.2.4.release)​

warning

RIOS 5.2.4 uses the new rWeb 5.2.4.release Please make sure you are running rWeb 5.2.4.release before you upgrade devices to RIOS 5.2.4. NOTE: Upgrading rWeb does not affect connected devices in any way.

RIOS v5.2.4

  • RS supports pcap features. (RG pcap will be available in the next release) See rWeb section for new screen displays supporting this function.
  • Improved filtering for small packet (payload size of 0-8 bytes) on UDP flood attack (AT-17).
  • Corrected error in RIOS 5.2.3 sp3 AT-1 Force_on codes.

rWeb 5.2.4.release

  • Added the ability to display the summary of a "customer" level information.
  • In the Zone Control screen, you can now display real time charts of traffic distribution based on:
    1. TCP, UDP, ICMP and others
    2. TCP: SYN, SYN-ACK, ACK, FIN, RST
    3. IPv4, IPv6
  • TCP dump capability added for RS (RG in next RIOS release).
  • You can now do scheduled daily, weekly and monthly reports. In the next release, auto email option will be enabled.
  • SNMP v1, v2 and v3 are enabled for all devices running RIOS 5.2.4. All pertinent data are reported under the RioRey enterprise MIBs.

5.2.3 sp3 System Release Notes (RIOS 5.2.3sp3, rWeb 5.2.3.release.3)​

warning

RIOS 5.2.3sp3 uses the new rWeb 5.2.3.release.3 Please make sure you are running rWeb 5.2.3.release.3 before you upgrade devices to RIOS 5.2.3sp3. NOTE: Upgrading rWeb does not affect connected devices in any way.

  • RIOS 5.2.3sp3 is a minor bug fix release for RIOS 5.2.3sp2. We discovered that a few database deleted entries was not propagated properly from rWeb to RIOS in 5.2.3sp2. This particular bug does not have operational impact, but is now corrected in 5.2.3sp3 release. This is an optional upgrade release, where all new RioRey systems will be shipped with 5.2.3sp3. However, it is not necessary to upgrade in field systems from 5.2.3sp2 to sp3.

5.2.3.release.3 rWeb Release Notes (rWeb 5.2.3.release.3)​

info

rWeb 5.2.3.release.3 is an bug fix release and is compatible with all RIOS versions 5.2.x and 5.1.x NOTE: Upgrading rWeb does not affect connected devices in any way.

  • rWeb 5.2.3.release.3 fixes a connection between rWeb and RIOS that caused the following settings to not update properly:
    • allow UDP traffic
    • allow Port 80 UDP traffic
    • allow ICMP traffic
    • allow ICMP pings

5.2.3 sp2 System Release Notes (RIOS 5.2.3sp2, rWeb 5.2.3.release.2)​

warning

There are no new rWeb release required for RIOS 5.2.3sp2. RIOS 5.2.3sp2 uses the exsiting rWeb 5.2.3.release.2 Please make sure you are running rWeb 5.2.3.release.2 before you upgrade devices to RIOS 5.2.3sp2.

For users new to 5.2.3 series of releases, please note the following key upgrades:

RIOS upgrade procedure starting RIOS release 5.2.3 has changed

  • RIOS updates are now saved in rWeb, so the user only need to upload it once to rWeb. Also, rWeb can store previous RIOS versions used. There are two ways to upload RIOS release into rWeb.
  • Method 1: Using the standard Administration Tab > Devices (drop down) > RIOS
    1. Click "Stage New Upgrade" button.
    2. In the New "Manage RIOS" window, you can now use "Upload to rWeb" to add a RIOS code from your computer to rWeb.
    3. After RIOS has been uploaded to rWeb, you can highlight the desired RIOS Version and click "Stage". This will start the RIOS transfer from rWeb to the device. When upload is completed, a simple "success" message will be shown.
    4. Once staging is successful, you can now click the "Upgrade" button to complete the upgrade task.
  • Method 2: Adding a new RIOS into rWeb without upgrading any RIOS devices.
    1. This control is in rWeb > Administration Tab > rWeb (drop down) > RIOS Management
    2. Once you downloaded the new RIOS version in your PC, go to RIOS Management screen and hit "Upload"
    3. This will store the RIOS release on rWeb and will be available to upgrade all RIOS devices.

RIOS 5.2.3sp2 Release Reason -- Bug fix for 5.2.3sp1 RG

  • This release affects RG only. Customers running RS on 5.2.3sp1 will not need to upgrade to sp2. If an upgrade to RS is applied, they will observe no changes with this upgrade. In this patch, the basic RG device drivers have been updated to not use SNMP to query the internal IBM high performance 10G switches. This workaround the memory leak issue with the IBM SNMP stacks.

Known Issues

  • Whitelisting or blacklist with AS and CC. The current release still have the blacklist/whitelist quantity restrictions that many AS/CC codes will overflow the blacklist and whitelist capacity of the RS or RG. This issue will be addressed in a later release.
  • When using rWeb.5.2.3.release.2, the following settings to not update properly:
    • allow UDP traffic
    • allow Port 80 UDP traffic
    • allow ICMP traffic
    • allow ICMP pings

All other feature of this release is documented in the RIOS 5.2.3 release notes.

5.2.3 sp1 System Release Notes (RIOS 5.2.3sp1, rWeb 5.2.3.release.2)​

RIOS 5.2.3sp1 requires NEW rWeb 5.2.3.release.2 Please upgrade rWeb to 5.2.3.release.2 before you upgrade devices to RIOS 5.2.3sp1.

info

All users of the "special releases" 5.2.2 sp2 through 4 are strongly recommended to upgrade to 5.2.3sp1 as soon as possible. 5.2.3sp1 incorporated all features and bug fixes in 5.2.2 sp2 through sp4.

For users upgrading to 5.2.3sp1, please note the following key upgrades:

RIOS upgrade procedure starting RIOS release 5.2.3 has changed

  • RIOS updates are now saved in rWeb, so the user only need to upload it once to rWeb. Also, rWeb can store previous RIOS versions used. There are two ways to upload RIOS release into rWeb.
  • Method 1: Using the standard Administration Tab > Devices (drop down) > RIOS
    1. Click "Stage New Upgrade" button.
    2. In the New "Manage RIOS" window, you can now use "Upload to rWeb" to add a RIOS code from your computer to rWeb.
    3. After RIOS has been uploaded to rWeb, you can highlight the desired RIOS Version and click "Stage". This will start the RIOS transfer from rWeb to the device. When upload is completed, a simple "success" message will be shown.
    4. Once staging is successful, you can now click the "Upgrade" button to complete the upgrade task.
  • Method 2: Adding a new RIOS into rWeb without upgrading any RIOS devices.
    1. This control is in rWeb > Administration Tab > rWeb (drop down) > RIOS Management
    2. Once you downloaded the new RIOS version in your PC, go to RIOS Management screen and hit "Upload"
    3. This will store the RIOS release on rWeb and will be available to upgrade all RIOS devices.

RIOS 5.2.3sp1 Release Reason

  • A customer reported a new variation of AT-11, Excessive Verb attack that earlier RIOS did not defend. This new attack variation tags the HTTP GET Request with a TCP Flag of PSH + ACK + FIN. This flag combination caused RIOS to treat the packet as FIN packets for analysis, and therefore did not capture the GET request correctly.
  • Release 5.2.3sp1 modified the RIOS TCP flags handler, and these packets are now included in all Layer 7 algorithms. Based on the packet capture from the attack, this AT-11 variation is now fully filtered. This change affects Attack Types: 7 through 16.
  • This change requires the new rWeb 5.2.3.release.2 (for a database default value change) as well as the RIOS 5.2.3sp1
  • TCP flag handler is the only change between 5.2.3 and 5.2.3sp1.

Known Issues

  • RG only bug: We discovered that the current IBM HT release we upgraded to in 5.2.3sp1 has a new SNMP bug. This SNMP bug causes the IOM7, IOM8, IOM9 and IOM10 high bandwidth switches to crash. In 5.2.3sp1 we changed an internal query to these IOM from telnet to SNMP, and the IBM new SNMP has a memory leak and crashes after a few days of use. This bug does not affect the RS, which is not based on the IBM platform. This bug has been fixed in 5.2.3sp2 by bypassing the SNMP function totally.
  • Whitelisting or blacklist with AS and CC. The current release still have the blacklist/whitelist quantity restrictions that many AS/CC codes will overflow the blacklist and whitelist capacity of the RS or RG. This issue will be addressed in a later release.

All other features of this release are documented in the RIOS 5.2.3 release notes.

5.2.3 System Release Notes​

RIOS 5.2.3 requires rWeb 5.2.3 Please upgrade rWeb to 5.2.3 before you upgrade devices to RIOS 5.2.3.

warning

All users of the "special releases" 5.2.2 sp2 through 4 are strongly recommended to upgrade to 5.2.3 as soon as possible. 5.2.3 incorporated all features and bug fixes in 5.2.2 sp2 through sp4.

For users upgrading to 5.2.3, please note the following key upgrades: RIOS upgrade procedure has changed

  • RIOS updates are now saved in rWeb, so the user only need to upload it once to rWeb. Also, rWeb can store previous RIOS versions used. There are two ways to upload RIOS release into rWeb.
  • Method 1: Using the standard Administration Tab > Devices (drop down) > RIOS
    1. Click "Stage New Upgrade" button.
    2. In the New "Manage RIOS" window, you can now use "Upload to rWeb" to add a RIOS code from your computer to rWeb.
    3. After RIOS has been uploaded to rWeb, you can highlight the desired RIOS Version and click "Stage". This will start the RIOS transfer from rWeb to the device. When upload is completed, a simple "success" message will be shown.
    4. Once staging is successful, you can now click the "Upgrade" button to complete the upgrade task.
  • Method 2: Adding a new RIOS into rWeb without upgrading any RIOS devices.
    1. This control is in rWeb > Administration Tab > rWeb (drop down) > RIOS Management
    2. Once you downloaded the new RIOS version in your PC, go to RIOS Management screen and hit "Upload"
    3. This will store the RIOS release on rWeb and will be available to upgrade all RIOS devices.

New Features

  • Added "Force On" filter mode for AT-1. This is to address a new SYN flood attack where the attacker would send short bursts of attacks, with sufficient time gaps between bursts that cause our algorithm to re-hunt for the attackers. This "Force On" mode keep the attack condition in a persistence state, allowing the RioRey device to instantaneously mitigate any subsequent attack burst. This is the first implementation of this new mode. This "Force On" mode will be available for all attack types in the future. In this initial release, there is a limit of 64 individual victim IP that can be added per device in the network. If your zone that you wish to "Force On" contains more than 64 IPs, the system will generate an error message. You will need to temporarily add a better defined zone to enable "Force On" for the particular IP under attack. Also, clicking the global "Monitor" or "Auto" buttons will take all controls within the zone out of "Force On" mode.
  • Added "AS" and "Country Code (CC)" references in both Source IP address displays, in Source Black List and Source White List definitions. See rWeb Administration Changes section on how to manage the AS/CC information.
  • Improved packet capture and display capabilities, this will be further enhanced in 5.2.4.
  • Individual Monitor/Auto setting for each mitigation class within a zone is now enabled. (Since 5.2.2)
  • Added Templates for the 25 Mitigation Settings. (Since 5.2.2)
  • Added "Traffic Control" to handle Invalid Packet, and classified as Attack Type 62. (Since 5.2.2)
  • Added Attacker Reporting Types(Since 5.2.2):
    • 61 = Manual Regex Blocked attacks
    • 62 = Invalid Packets
    • 63 = Black Listed Packets
  • Layer 7 Attacker Packet Capture feature and display capability (since 5.2.0)
  • rWeb - Report changes:
    1. The daily report added Report Sample counts and sorts attackers based on samples received per attacker IP.
    2. The daily report reports both Source and Destination IP for detail half hour records. (since 5.2.2)
  • rWeb - Administration changes:
    1. Under Device Summary, there is a new Device Logs reporting device related logs.
    2. Under Zone Management, there is a new resource summary chart showing which customer and zone are using various lists and allows the user to quickly go to the zone to make any necessary adjustments.
    3. Under rWeb > "AS and CC Management" Tab, this is a new screen to manage AS and CC information. Check our FAQ section to read more about our AS/CC data source.
    4. For RG devices only, under Device, Networking Tab, there is the new Port-VLAN Patch Panel controls. When system are upgraded from 5.1.5 to 5.2.0, all ports will be pre-configure to standard WAN/LAN configuration. (since 5.2.2)
  • RIOS changes:
    1. Added Forced On mode for AT-1
    2. New Port-VLAN Patch Panel now restricted to RG only (since RIOS 5.2.2)
    3. Ethernet Port IO device driver upgraded to most recent release from chip manufacturer. This upgrade fixes a port crash issue in the RS. (since RIOS 5.2.2)

Known Issues

  • RG Only: When upgrading from 5.1.x to 5.2.x, due to a major system driver reload on all modules, the RG will go through two reboot cycles. The combined cycles will complete in about 30 minutes. However, at time ~ 15 minutes, the system will seem to return to normal function for a few minutes and then reboot again. This double reboot is normal. If you are setting the Fiber Bypass (RB) manually before the upgrade, please wait for 30 minutes until the system showed NORMAL (Green LED and connected) before you switch Fiber Bypass off, and return the traffic back to the RG.
  • SNMP module is being replaced which will support SNMP v3 properly. This new module was not qualified for 5.2.3 and will be release in next release.
  • Loading new AS/CC table using Mac OS X Safari and Windows with IE9 browsers does not work properly. Even though the screen will be stuck at "connecting", closing the browser window will close the upload session. Please use FireFox or Chrome browsers instead.

Major Bugs Fixed

  • An RG port instability in 5.2.3 release has been fixed. This bug is due to IBM HT chassis MM firmware bug. We have made a successful work around to this bug. (fixed since 5.2.2 sp2)
  • A display bug reported in 5.2.2: In a rare condition, the Zone Traffic Summary chart in Zone Control (Mitigation) screen can display the wrong data and show a saw-tooth chart instead. This is due to refresh cycle timing overlap between the rWeb system and the browser refresh cycle. To fix this, just click the Broswer's Page Refresh button (not the chart update button). This action just restarts the browser refresh window to another random start time with respect to the rWeb refresh time. (fixed since 5.2.2 sp3)
  • The search field in Report generation control sorts Queued Date (fixed since 5.2.2 sp3.)
  • Ethernet Port IO device driver upgraded to most recent release from chip manufacturer. This upgrade fixes a port crash issue in the RS. (fixed since 5.2.2)
  • Since RIOS 5.2.1, Port-VLAN Patch Panel is restricted to RG ONLY. There is no option for PVPP in RS, RX and RE.
  • Fixed since RIOS 5.2.2 sp4: The state tracking mechanism for TCP traffic has been improved for better response. As a result, AT5, (FIN/RST) attack sensitivity is affected and systems that generate more than 1 pair of FIN/RST at end of a session will see some of the excess FIN/RST packets dropped. If these are small events with less than 1,000pps filtered FIN/RST packets, then the event will be reporting as dropped Attackers only and no Victims are declared. Since these are extra FIN/RST packets, customer performance are not affected.

5.2.2 System Release Notes​

RIOS 5.2.2 requires rWeb 5.2.2 Please upgrade rWeb to 5.2.2 before you upgrade devices to RIOS 5.2.2.

For users upgrading to 5.2.2, please note the following key upgrades:

  • rWeb - Zone Control (Mitigation) changes:

    1. Individual Monitor/Auto setting for each mitigation class within a zone is now enabled.
    2. Added Templates for the 25 Mitigation Settings.
    3. Added "Traffic Control" to handle Invalid Packet, and classified as Attack Type 62.
    4. Added Attacker Reporting Types:
    • 61 = Manual Regex Blocked attacks
    • 62 = Invalid Packets
    • 63 = Black Listed Packets
    1. Layer 7 Attacker Packet Capture feature and display capability (since 5.2.0)
    2. Added small number of samples of spoofed attack packets in Attacker Packet Capture feature above.

  • rWeb - Report changes:

    1. The daily report reports both Source and Destination IP for detail half hour records.

  • rWeb - Administartion changes:

    1. For RG devices only, under Device, Networking Tab, there is the new Port-VLAN Patch Panel controls. When system are upgraded from 5.1.5 to 5.2.0, all ports will be pre-configure to standard WAN/LAN configuration.

  • RIOS changes:

    1. New Port-VLAN Patch Panel now restricted to RG only.
    2. Ethernet Port IO device driver upgraded to most recent release from chip manufacturer. This upgrade fixes a port crash issue in the RS.

Known Issues

  • RG Only: When upgrading from 5.1.x to 5.2.x, due to a major system driver reload on all modules, the RG will go through two reboot cycles. The combined cycles will complete in about 30 minutes. However, at time ~ 15 minutes, the system will seem to return to normal function for a few minutes and then reboot again. This double reboot is normal. If you are setting the Fiber Bypass (RB) manually before the upgrade, please wait for 30 minutes until the system showed NORMAL (Green LED and connected) before you switch Fiber Bypass off, and return the traffic back to the RG.
  • In a rare condition, the Zone Traffic Summary chart in Zone Control (Mitigation) screen can display the wrong data and show a saw-tooth chart instead. This is due to refresh cycle timing overlap between the rWeb system and the browser refresh cycle. To fix this, just click the Browser's Page Refresh button (not the chart update button). This action just restarts the browser refresh window to another random start time with respect to the rWeb refresh time.
  • The search field in Report generation control does not work.
  • The state tracking mechanism for TCP traffic has been improved for better response. As a result, AT5, (FIN/RST) attack sensitivity is affected and systems that generate more than 1 pair of FIN/RST at end of a session will see some of the excess FIN/RST packets dropped. If these are small events with less than 1,000pps filtered FIN/RST packets, then the event will be reporting as dropped Attackers only and no Victims are declared. Since these are extra FIN/RST packets, customer performance are not affected.

Major Bugs Fixed

  • Ethernet Port IO device driver upgraded to most recent release from chip manufacturer. This upgrade fixes a port crash issue in the RS.
  • Since RIOS 5.2.1, Port-VLAN Patch Panel is restricted to RG ONLY. There is no option for PVPP in RS, RX and RE.

5.2.1 System Release Notes​

danger

RIOS 5.2.1 has been deprecated due to a bug in the RS Port VLAN Patch Panel (PVPP). PVPP has been removed from the RS (retained in the RG) and re-released as 5.2.2.

5.2.0 Milestone System Release Notes​

RIOS 5.2.0 requires rWeb 5.2.0 Please upgrade rWeb to 5.2.0 before you upgrade devices to RIOS 5.2.0.

For users upgrading to 5.2.0, please note the following key upgrades:

  • rWeb - Zone Control (Mitigation) changes:

    • Individual Monitor/Auto setting for each mitigation class within a zone is now enabled.
    • New Layer 7 attacker packet capture and display capability.

  • rWeb - Report changes:

    • The daily report reports both Source and Destination IP for detail half hour records.

  • rWeb - Administration changes:

    • Under Device, Networking Tab, there is the new Port-VLAN Patch Panel controls. When system are upgraded from 5.1.5 to 5.2.0, all ports will be pre-configure to standard WAN/LAN configuration.

  • RIOS changes:

    • New Port-VLAN Patch Panel

Other Known bugs

  • The search field in Report generation control does not work.