Skip to main content

6.0 Release Notes

The release notes of all 6.0 rWeb and RIOS versions are stored here.

6.0.1 System Release Notes (rWeb 6.0.1.release)​

rWeb 6.0.1.release

Bug Fixes

  • Fix for charts not rendering properly when zoomed or set to fullscreen.

Known Issues

  • When changing NTP servers used by rWeb, rWeb will incorrectly report that the servers are unreachable. rWeb is actually resynchronizing time with those servers and displays the "servers unreachable" message rather than the current status of the synchronization. Once the synchronization process is complete it will show the correct time status.

Configuration Recommendation We are observing an uptick in AT1, AT2, and AT5 excessive duplicate victims as a result of the Mirai botnet. In certain cases, the number of victims generated by this traffic at our default setting of '10' for 'Maximum Duplicates' under these attack types reaches excessive levels (millions of victims).

As a general recommendation, we suggest adjusting the 'Maximum Duplicates' controls for these attack types to 30 or 40. This will still afford effective mitigation to attacks but prevent excessive victim churn that has in some cases affected rWeb responsiveness.

An example script to make this change for AT1 can be found here.

6.0.3 System Release Notes (RIOS 6.0.3)​

RIOS v6.0.3 (RE2000, RE4000, RE2200, RE4200, RE5200, RX10, RS10, RS30, RG)

info

A RioRey license is required to upgrade a filter device to RIOS 5.3.0 or later. If you don't have one, please contact RioRey.

Enhancements

  • Added support for new RX10 processors.

Bug Fixes

  • Fixed issue on RG where LACP links fail after some packet processing.

Known Issues

  • If both AT17 and AT22 are set to "Off", AT21 must also be set to "Off" or traffic will be negatively impacted.
  • IPv6 ICMP attacks will erroneously be reported with IPv4 addresses.

rWeb 6.0.0.release (No rWeb Upgrade Required)

Known Issues

  • When changing NTP servers used by rWeb, rWeb will incorrectly report that the servers are unreachable. rWeb is actually resynchronizing time with those servers and displays the "servers unreachable" message rather than the current status of the synchronization. Once the synchronization process is complete it will show the correct time status.

Configuration Recommendation We are observing an uptick in AT1, AT2, and AT5 excessive duplicate victims as a result of the Mirai botnet. In certain cases, the number of victims generated by this traffic at our default setting of '10' for 'Maximum Duplicates' under these attack types reaches excessive levels (millions of victims).

As a general recommendation, we suggest adjusting the 'Maximum Duplicates' controls for these attack types to 30 or 40. This will still afford effective mitigation to attacks but prevent excessive victim churn that has in some cases affected rWeb responsiveness.

An example script to make this change for AT1 can be found here.

6.0.2 System Release Notes (RIOS 6.0.2)​

RIOS v6.0.2 (RE2000, RE4000, RE2200, RE4200, RE5200, RX10, RS10, RS30, RG)

info

A RioRey license is required to upgrade a filter device to RIOS 5.3.0 or later. If you don't have one, please contact RioRey.

Bug Fixes

  • Fixed condition on RG devices where packets could sporadically be reflected on their input ports.

Known Issues

  • If both AT17 and AT22 are set to "Off", AT21 must also be set to "Off" or traffic will be negatively impacted.
  • IPv6 ICMP attacks will erroneously be reported with IPv4 addresses.

rWeb 6.0.0.release (No rWeb Upgrade Required)

Known Issues

  • When changing NTP servers used by rWeb, rWeb will incorrectly report that the servers are unreachable. rWeb is actually resynchronizing time with those servers and displays the "servers unreachable" message rather than the current status of the synchronization. Once the synchronization process is complete it will show the correct time status.

Configuration Recommendation We are observing an uptick in AT1, AT2, and AT5 excessive duplicate victims as a result of the Mirai botnet. In certain cases, the number of victims generated by this traffic at our default setting of '10' for 'Maximum Duplicates' under these attack types reaches excessive levels (millions of victims).

As a general recommendation, we suggest adjusting the 'Maximum Duplicates' controls for these attack types to 30 or 40. This will still afford effective mitigation to attacks but prevent excessive victim churn that has in some cases affected rWeb responsiveness.

An example script to make this change for AT1 can be found here.

6.0.1 System Release Notes (RIOS 6.0.1)​

RIOS v6.0.1 (RE2000, RE4000, RE2200, RE4200, RE5200, RX10, RS10, RS30, RG)

warning

When upgrading to 6.0.0, any IPv6 traffic will automatically be managed by the Default Customer and Zone unless you configure new routes first. It is recommended that you upgrade rWeb first and preconfigure any specific zones for IPv6 before upgrading your filter devices.

Release Recommendation This release fixes the issue that could affect an RS30 or RX10 that had not been cold rebooted (power cords pulled and reinserted) for over 200 days. In order to make sure the patch is applied correctly, we recommend triggering a reboot from within rWeb after upgrading to this version. No further cold reboots are required.

New Features

  • IPv6 support. Initial filtering support includes TCP Attacks (AT1, 2, 3, 4, 5, and 6), Layer 7 and Session Attacks (AT8, 10, 11, 12, 13, 14, and 15), Regex (AT61), Invalid Traffic (AT62), and White / Black Lists. There is currently partial UDP filtering (AT18, protocol checks in AT22) and ICMP filtering (AT24).

Enhancements

  • Performance enhancements made for CPU affinity selection.
  • Enabled more detailed database logging.

Bug Fixes

  • Applied critical kernel patch that fixed issues with the TSC being set incorrectly on RS30s and RX10s, which was causing various performance and interface problems.
  • Fix for interface statistics process that was polling twice as often as expected.
  • Removed platform code that was trying to copy data for which it had no permissions.
  • Fixed a bug where certain TCP options in SYN flagged packets were parsed incorrectly.

Known Issues

  • If both AT17 and AT22 are set to "Off", AT21 must also be set to "Off" or traffic will be negatively impacted.
  • IPv6 ICMP attacks will erroneously be reported with IPv4 addresses.

rWeb 6.0.0.release

Known Issues

  • When changing NTP servers used by rWeb, rWeb will incorrectly report that the servers are unreachable. rWeb is actually resynchronizing time with those servers and displays the "servers unreachable" message rather than the current status of the synchronization. Once the synchronization process is complete it will show the correct time status.

Configuration Recommendation We are observing an uptick in AT1, AT2, and AT5 excessive duplicate victims as a result of the Mirai botnet. In certain cases, the number of victims generated by this traffic at our default setting of '10' for 'Maximum Duplicates' under these attack types reaches excessive levels (millions of victims).

As a general recommendation, we suggest adjusting the 'Maximum Duplicates' controls for these attack types to 30 or 40. This will still afford effective mitigation to attacks but prevent excessive victim churn that has in some cases affected rWeb responsiveness.

An example script to make this change for AT1 can be found here.

6.0.0 System Release Notes (rWeb 6.0.0.release)​

rWeb 6.0.0.release

warning

When upgrading to 6.0.0, any IPv6 traffic will automatically be managed by the Default Customer and Zone unless you configure new routes first. It is recommended that you upgrade rWeb first and preconfigure any specific zones for IPv6 before upgrading your filter devices.

New Features

  • IPv6 support. Zone routing now supports IPv6 addresses in addition to IPv4 addresses. All operations that previously used IPv4 addresses now can use IPv6 addresses as well (e.g. IP search, tcpdump, filter list queries, etc). Filtering functionality will require the upcoming 6.0.0 RIOS release.
  • Users can view the configuration history of a Zone to see what controls were adjusted and when, and quickly revert to earlier revisions.
  • Users can now change the default time zone used by rWeb.

Enhancements

  • Upgraded backend Java environment.
  • Improved victim processing efficiency.

Bug Fixes

  • Fixed an issue where an "attack" chart would appear to be sawtoothed.
  • Disconnected devices will no longer appear on filter list query menus.
  • Fixed an issue where an IP search would display an incorrect blacklist expiry time.
  • Fixed an issue where a search for an IP would hang in AS/CC if it was not part of an AS.
  • Fixed the subtype descriptions for AT19.
  • Fixed an issue where Radius and TACAS logins were creating duplicate database entries.

Known Issues

  • When changing NTP servers used by rWeb, rWeb will incorrectly report that the servers are unreachable. rWeb is actually resynchronizing time with those servers and displays the "servers unreachable" message rather than the current status of the synchronization. Once the synchronization process is complete it will show the correct time status.
  • AT9 filter sensitivity will not populate correctly when comparing configuration history.