Event time issue - IPS 4240, v5.0, VMS.

Hi,
I am having this unique issue. Whereas the IPS system time is correct, and I have set a UTC offset of 330 min (being in the GMT +5.30 hrs time zone.), I am still seeing the event time on the IEV as UTC, and not the system time. This is kinda tedious trying to keep track of the actual local time the event occcurred. The system clock on the IPS shows correct local time.
Also, on the VMS server, the system time is the same as the IPS. However, whenever I open up the SecMon, to view the event, it gives me a funny default start & end time, which is about 3 beyond the system time (I expect the time range reflected in the SecMon, should correspont the system time of the VMS machine, when the SecMon->Monitor->Events link was clicked.) For e.g. if I click on the SecMon->Monitor->Events link at say 10.00 am, on 13th April, I expect the fetch events time range to show from 13-April-2005 10:00:00 hrs to 13-Aril-2005 10:00:00 hrs. However, what it actually displays is 13:00:00 hrs to 13:00:00 hrs. I am at a loss where this time difference is creeping up from. Also, if instead of the time range, I specify, say last 1 or 2 hrs, it wont show me any events. (This I suspect is because of the funny 3 hr time difference that has crept in.) I can only see the events, if I ask the events of beyond last 3 hrs.
Any suggestions how to resolve the same? I am not using any NTP servers currently. Would that help?
Thanks in advance.
Ajay.

Hi Ajay
Its not a major problem either in your CISCO IDS and CISCO VMS. It is time synchronizing factor involved in this mismatch time view on your Sec Mon.
What version of VMS you deployed?
If it is not updated version then download the PERL script Workaround files from Download Center then run on it.
After that, the problem will be resolve.
If it will not resolve then pls reply.
Thanks

Similar Messages

New to IPS 4240 - What else can I use to manage it?

I have just purchased a Cisco IPS 4240 and have it up and running. Have been using the IEV to view IPS information and that works ok. The VMS 2.2 that came included with the IPS will not work with the current Cisco works (LMS 2.5) installation that we have.
My question is, is there any other tool besides the IEV and the VMS 2.2 that I can use to mange/monitor my IPS? the IEV seems so limited.
I have downloaded the newer VMS from the Cisco site and am planning to test that this comming week, but wanted to know ahead of time if I needed to waste my time with this tool or not.
Thanks!

The latest CSMARS release is promising and honestly the netforensics solution offered by Cisco probably wouldn't be a good fit for the op, but I think Cisco needs to rething pushing the MARS in leui of everything else. As a previous customer of netforensics, and now a user of CSMARS...there are definitely many things that netforensics does better than CSMARS.
My biggest beef with CSMARS is the seemingly casual way in which it treats time and "raw messages". IMHO, these should be sacred to any SIM. I can elaborate, but for the sake of brevity I'll just give a couple examples:
The signature name reported in the "raw message" that MARS makes available is not always correct. Also, custom signature events report as "unknown" in the "raw message". Clearly this is not a "raw message" by any reasonable interpretation...MARS is writing bits that never existed in the original message.
the event contextual information is very often truncated. If you rely on this a great deal, the MARS probably isn't for you. There's also no interface for decoding it, requiring a cut-and-paste into your favorite decoder.
Believe me, I could go on. On the bright side, the MARS is showing promise...I was able to cross off my list quite a few issues after the latest upgrade.
Matt

IPS 4240 software 6.2(3)E4

Hello!
I have a sensor IPS-4240 which holds IPS software 6.2(3)E4. Right now we havn't got a license.
With the device wh have almost 100% cpu usage all the time:
show statistics host
General Statistics
   Last Change To Host Config (UTC) = 27-Dec-2010 14:51:19
   Command Control Port Device = Management0/0
Network Statistics
Memory Usage
   usedBytes = 1426128896
   freeBytes = 558419968
   totalBytes = 1984548864
Summertime Statistics
   start = 02:00:00 UTC Sun Mar 27 2011
   end = 03:00:00 UTC Sun Oct 30 2011
CPU Statistics
   Usage over last 5 seconds = 100
   Usage over last minute = 100
   Usage over last 5 minutes = 100
Memory Statistics
   Memory usage (bytes) = 1426128896
   Memory free (bytes) = 558419968
From service accont I see that only one process eats CPU - mainApp.
I even created addition virtual sensor vs1 where I have disabled all signatures. It gave me no result.
Situation can be changed for a while after the sensor's reboot, but not for long time.
show interfaces doesn't show a lot of input traffic too.
Event log contains only following warnings:
evError: eventId=1293461883161643337 severity=warning vendor=Cisco
originator:
    hostId: XXXXXX
    appName: notification
    appInstanceId: 409
time: 2011/01/19 15:22:56 2011/01/19 21:22:56 GMT+06:00
errorMessage: name=errWarning - the subscription lost data [IdsEventStore::readSubscription()]
What can be a problem? How can I reduce CPU usage?
With hope to resolve the issue

It would be difficult to pin point what the exact issue is with the high CPU just by the information provided in the post. It seems that the mainApp is causing the high CPU, however, it is worth investigating further. I would suggest that you log a Cisco TAC case so further investigation can be performed.
Alternatively, you can try to upgrade the software to the latest version of 7.0.4(E4) which has engine improvement.

IPS 4240 Design Question

I have two IPS 4240s that may be placed between our internal network and our extranet firewall. The firewall set is your standard ASA-5520 active/failover pair connected to two switches.
Q1 - If I am not worried about atomic attacks, is there any other benefit to having the IPS inline over promiscuous?
Q2 - Whether inline or promiscuous, is it necessary to connect the single IPS to both switches in order to receive packets when an ASA failover occurs? If so, is it done physically or via RSPAN?
Q3 - If the IPS fails and it is configured inline, do the interfaces fail open (traffic continues to pass) or closed (traffic is dropped)? I could not find that on Cisco's site.
Thanks!

A1 - There are a few things that in-line mode can clean up by deafult, but that can also bite you. Check out some of the other forum posts on having ssh dropped without alerts. Since you have reduntant 4240s the realibility of the IPS sensors in-line shouldn't affect you as much. Just don't update them at the same time.
A2 - Only the signatures that need state will be effected by a failover. Hopefully failovers do not happen frequently enough for missing a few potential hits to be an issue. If you are really performing good analysis and tuning out your false positives, then you might want to connect both sensors to both switches.
A3 - You can configure the 4240s to fail-open (pass the traffic thru the sensor when it fails) or fail-closed (do not pass traffic during sensor failure). Since you have dual firewalls, switches and sensors, you can fail closed and force the traffic thru the running sensor and firewall. If one sensor is standby, you may want to make him fail open, so that you can still pass traffic in the event both sensors are down.

How to configure IPS 4240 - K9 to send log file to syslog server

I am looking for the commands in how to configure IPS 4240-k9 to send log file to SYSLOG server. If anybody has or came across similer issue please advice.
Thanks in advanced.

Ali -
I am sorry to tell you, but the Cisco IPS Sensors do not send Syslog messages. Your only options for sending signature event information are:
SDEE (an TLS Encrypted XML formatted message) the sensor is the SDEE Host and your event receiver (MARS, IME, Intelitactics, etc) is the client.
SNMP Traps - You need to set the "Action" on each signature you want the sensor to send a trap.
- Bob

IPS 4240 even backup/retrewals

Hi,
We having IPS three number of 4240 placed on different segments of our network. We having following querries about collecting IPS logs;
1) We need to collect IPS events/logs to external server
2) is there any other application that we can retriew IPS logs other than Cisco IME
3) can cisco IME retriew logs taken from a backup server in the same manner that it retriew in current logs (with colored, graphs etc).
4) what is the correct logs storage capacity of the IPS 4240 appliance, when I see TAC IPS media Series, Episode 2 - IPS Hardware
its mentioned as 2GB DDR RAM and 512MB flash. (https://supportforums.cisco.com/docs/DOC-13565)
However when I checked my IPS Total memory 1984MB and Total Data Storage 788MB. what are these figures..?
5) where exactly save the IPS logs, will the event goes off once we do power recrycle?.
Appreciate if some one can answer with correct solutions to above questions

yes you are right, and it is clear for me, but i think using ASDM-IDM launcher can
be used for both ASA and IPS.
but in my case currently, i am upgrading only the IPS to 7.0(2)E4 from version 7.0(2)E3. so i don't want to loose the ability to access both ASA and IPS(with new version).
in addition, when i do Access the IPS through Https, it do not create any shortcut on my screen. moreover, when i do try and click on "You can also install DM Launcher to run IDM." i got the DM Laucnher with version 1.5(37) and not with version 1.5(49)
PS:
- i rebooted the sensor, same issue.
- i cleared the cache folder in the path "C:\Users\Administrator\.asdm\cache" & "C:\Users\Administrator\.idm\cache" also same issue
problem persists.
Please Advice

IPS 4240 problem

Hi All,
we've installed IPS 4240 since 6 months ago and everything worked fine. Then I noticed time in IPS was not correct, then in the IDM, I've changed summer time to 60 minutes offset to get the right time from NTP. then reboot the IPS, since that time users inside the network are not able to connect to internet, and basically traffic from inside to outside is blocked. But traffic from outside to inside is fine and outside users are able to hit to the web server in DMZ zone.
any idea would be very appreciated.
thanks
Alex

Changing your time offset should not cause this type of problem. Check for any non-running processes with a "sh ver", reboot your sensor and check the system log for some signs of trouble or blocking with "sh events past 01:00".
Open a TAC case to get additional help.

IDS-4210 picks up what IPS-4240 misses, strange duplex/interface problems

I just installed a IPS-4240 inline on our primary internet inbound connection. I decided to leave the 4210 in place for a week or two while I tuned the signatures. It is receiving a span of the same traffic that the 4240 is receiving.
I noticed today that the 4210 is picking up sig 3250 and the 4240 is no. The first thing I checked to make sure that the 4240 has this signature enabled, and it is. Anyone have any thoughts? BTW, All sensors are on the same version 5.1.1 and running s211 and managed through VMS.
I would also like to mention that I had issues on the 4240 and its interfaces. Management only runs at half duplex and the interfaces that connect to our PIX. I ended up having to put a switch between the 4240 and the Pix 515e to solve the duplex issues.
Anyone have any thoughts on this part

I had the same duplex problem with my 4240 sensor connecting to my PIX. The only way I could get it to work without errors is to set both the sensor and the PIX interfaces to auto/auto. I worked with Cisco on this problem. No resolution, just the workaround. As far as sig 3250, IPS and IDS signatures may be a little different. I assume you span from the inside and run your in-line outside your firewall? If this is the case, then the 4240 sensor may see different traffic than the 4210.

What happened to event times in the monthly calendar?

I upgraded (not really) to Mavericks and there are numerous issues; mail showing headers and no content, safari pages open completely jumbled and an essential calendar feature, event time in the month view, is gone.
Apple seems to be dumbing down it's systems for personal use while flipping the bird to corporate users.

Hey there,
You can get the times to appear in regular (not full screen) view as well - just grab the edge of the calendar and drag it out to the left or right a bit; the times appear automatically at a certain window size.
from here:
https://discussions.apple.com/message/23735911#23735911
cheers,
AT

Google calendar event times are shown as -1h

Summary:
When I create a new event in the built in WP8 calendar app to a Google calendar the time of the event is being displayed as one hour earlier.
Steps to reproduce:
Create a new event in calendar. Choose one of the Google calendars configured (I have two configured in my phone). Set time as 2013/07/17 16:00. Save the event.
Expected behavior:
The event time in the agenda view is shown as 2013/07/17 16:00.
Observed behavior:
The event time in the agenda view is shown as 2013/07/17 16:00 for a few seconds. It then automatically changes to 2013/07/17 15:00.
Other notes:
I have two Google calendars configured. I can observe the same misbehavior on both.
I also have a Microsoft (@hotmail.com) calendar configured. This works as expected.
When I log into my Google calendar using a web browser, the time is shown as expected.
When I use a third party calendar (Chronos) and sync my Google account directly, the time is shown as expected.
When I use a third party calendar (Chronos) and use it simply as an interface to the built in WP calendar the time is off again showing 2013/07/17 15:00.
The timezone on my WP is set to (UTC) London.
I started noticing this perhaps a week ago. It was working as expected before.
Phone model is Nokia Lumia 925
Phone OS version is 8.0.10327.77
Notes 1-6 suggests to me that the internal calendaring module in WP8 fails to recognize DST (daylight saving time) in timezone (UTC) London or misinterprets relevant information fields on Google calendar objects.
Note 7 suggests to me that this is related to an update to my WP8 phone or a change in Google calendar API.
Any help is much appreciated, this is driving me rather nuts.
Thanks,
Kaarel

Further investigation reveals this only happens when the event is created from within WP native calendar app and disappears when I make an edit to the event in any other calendar client including Google web. So a more appropriate description of the problem would be:
"Native calendar app keeps subtracting 1h off a Google calendar event on EVERY edit"
Create an event at 2013/07/17 15:00 in WP native calendar app. Result: Event shows as 2013/07/17 15:00 in the calendar app for a few seconds, then updates itself to 2013/07/17 14:00.
Edit the event title and save in WP native calendar app. Event time moves by -1h again to 2013/07/17 13:00.
Edit the event title in Google web calendar.
Subsequent edits in WP native calendar do not mess up the time any longer. If I fix the time to what I originally intended (2013/07/17 15:00) in WP native calendar app, it stays there and shows correctly in all previously mentioned calendar viewers.
I just learned that Lumia 925 was released with GDR2 update pre-installed. This update is only now being made generally available. If the issue is secific to the CalDAV implementation in GDR2 rather than specific to my phone only, this would make a lot of angry people. I hope I'm wrong on this though as it's an extremely frustrating problem.

How do I correct the Event time stamp in iPhoto?

When I updated my iMac to Lion, the Events in iPhoto are no longer sequenced by time correclty. The incorrectly sequenced Events have the wrong time / data stamp. How do I edit the Event time/date stamp to correct the problem?

Hi LarryHN,
The version of iPhoto is 8.1.2. I found your workaround on other strings, and tried it, to no avail. This issue has happened to three of my Event folders -- all from the same three-week trip. I had each day separated into different events and named consecutively. At some point, I uploaded all those photos to photobucket, and I believe the three troublesome Events perhaps were corrupted in some way after that upload? Regardless, I can't seem to fix it. All of the photos have the correct date (for example, in one Event, all photos are dated 12/25/11). However the date range on the Event is 12/31/09-1/7/12. So, those three Events keep getting sorted out of sequence.
I opened one of the Events, highlighted one photo and selected Create Event. That new photo became a new Event. I re-named it, and dragged all the photos from the old Event into the new Event. ...Unfortunately, the new Event still has the weird Date Range on it?
Any ideas?

Execution Time Issue

Help Please!!!
I've been searching for an execution time issue in our application for a while now. Here is some background on the application:
Collects analog data from a cDAQ chassis with a 9205 at 5kHz
Data is collected in 100ms chunks
Some of the data is saved directly to a TDMS file while the rest is averaged for a single data point. That single data point is saved to disk in a text file every 200ms.
Problem: During operation, the VI that writes the data to the text file will periodically take many hundreds of milliseconds to execute. Normal operation execution times are on the order of 1ms or less. This issue will happen randomly during operation. It's usually many seconds between times that this occurs and it doesn't seem to have any pattern to when the event happens.
Attached is a screenshot of the VI in question. The timing check labeled "A" is the one that will show the troubling execution time. All the other timing checks show 0ms every time this issue occurs. I simply can't see what else is holding this thing up. The only unchecked subVI is the "append error call chain" call. I've gone through the heirarchy of that VI and ensured that everything is set for reentrant execution. I will check that too soon, but I really don't expect to find anything.
Where else can I look for where the time went? It doesn't seem to make sense.
Thanks for reading!
Tim
Attachments:
Screen Shot 2013-09-06 at 9.32.46 AM.png ‏87 KB

You should probably increase how much data you write with a single Write to Text File. Move the Write to Text File out of the FOR loop. Just have the data to be written autoindex to create an array of strings. The Write to Text File will accept the array of strings directly, writing a single line for each element in the arry.
Another idea I am having is to use another loop (yes another queue as well) for the writing of the file. But you put the Dequeue Element inside of another WHILE loop. On the first iteration of this inside loop, set the timeout to something normal or -1 for wait forever. Any further iteration should have a timeout of 0. You do this with a shift register. Autoindex the read strings out of the loop. This array goes straight into the Write to Text File. This way you can quickly catch up when your file write takes a long time.
NOTE: This is just a very quick example I put together. It is far from a complete idea, but it shows the general idea I was having with reading the queue.
There are only two ways to tell somebody thanks: Kudos and Marked Solutions
Unofficial Forum Rules and Guidelines
Attachments:
Write all data on queue.png ‏16 KB

TCP RESET - CISCO IPS 4240 in IDS Mode - Block Teamviewer

I would like to block teamviewer in my network. we are using CISCO IPS 4240 in IDS Mode. I found that there are signatures for teamviewer in latest Signatures.
We have only configured promiscuous interface, I read that we can issue TCP resets thru promiscuous interface as well (recommended is dedicated tcp reset interface).
However in my case, I found that Signatures for teamviewer is not getting fired even after getting successful teamviewer connections.
I am a beginner is IPS, Any inputs will be valuable for me.

We're talking about sigs 15002-0, -1, -2 here. They are by default shipped disabled and retired, so you'll want to enable and activate them.
For these, the signature settings are not hidden and what they look for is pretty clearly documented in the sig description.
-0 looks for some specific DNS requests on TeamViewer's startup. TCP resets will have no effect on this.
-1 looks for specific traffic to tcp port 5938 which would indicate Teamviewer's direct-connection method
-2 looks for traffic indicating use over http when teamviewer is configured to use a proxy
TCP resets are a best effort response, they aren't going to be a 100% effective stop

Cisco IPS 4240 stops file downloads at 90%

Hi everybody. I have a Cisco IPS 4240 with version 7.0.4 installed and upgraded to the last signature. But since it was installed i have the issue with some file downloads because the IPS stops the file at 90-99% of download percentage (in some cases, not all), The ips is inline in front of firewall, some partner say me that i have to change the mode to promiscuous for the solution of the issue, but i think that if the IPS was designed for work inline, i dont have to change anything and maybe some expert of the forum have the correct answer. Or this issue have solution with configuration changes.
Sorry by my write english.... I try to find some signature that causes the issue but if i disabled the sensor, the issue occurs. The firewall is not the problem because if i connect a laptop in front of the firewall and behind of IPS the issue occurs too. Well i have now some months trying of find a solution. In the page of Cisco not find some similar.... [:-(
Pd. An example of files that stop when downloads is Apple Itunes... or Microsoft Patch, or Vmware software by example.
Thanks for your response are greatly appreciated.

Thnaks for your help this is the last packets before freeze the download:
The size of the download with problems is random, sometimes ocurrs with small size downloads sometimes ocurrs with large downloads. The download of the example have 47 MB, I think that the traffic is dropped and the tcp conn timeout. Do you see some anomalies in this traffic portion?.
14:55:20.536119 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.536122 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.536420 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.536718 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.536820 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537123 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537125 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537517 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537520 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537522 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537821 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.537823 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.538116 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.538118 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.538415 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.538418 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.544207 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.544307 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638362 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638365 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638463 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638562 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638862 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638864 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.638866 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639164 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639166 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639560 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639562 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639564 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.639960 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.640260 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.640263 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.640568 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.641958 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.641960 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.642158 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.742304 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.742603 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.742605 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.742607 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.742903 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.743202 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.743302 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.743601 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.745000 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.745100 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.845347 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.845548 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.845550 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.845647 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.845845 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.846245 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.846247 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.846544 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 47929166 win 65335
14:55:20.849040 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48010926 win 65335
14:55:20.849439 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48012386 win 65335
14:55:20.948787 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48015306 win 65335
14:55:20.948789 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48018226 win 65335
14:55:20.952982 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48021146 win 65335
14:55:20.953679 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48024066 win 65335
14:55:21.055723 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48029906 win 65335
14:55:21.055725 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48032826 win 65335
14:55:21.055930 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48035746 win 65178
14:55:21.058919 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48037206 win 65335
14:55:21.068809 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48040126 win 65335
14:55:21.068812 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48043046 win 65335
14:55:21.069006 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48045966 win 65335
14:55:21.070103 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48048886 win 65335
14:55:21.158967 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48051806 win 65335
14:55:21.159265 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48054726 win 65335
14:55:21.159465 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48057646 win 65335
14:55:21.159864 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48060566 win 65335
14:55:21.159867 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48063486 win 64605
14:55:21.162162 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48066406 win 63875
14:55:21.162260 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48066406 win 65335
14:55:21.172245 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48069326 win 65335
14:55:21.172248 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48072246 win 65335
14:55:21.172545 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48075166 win 65335
14:55:21.172645 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48078086 win 64605
14:55:21.172744 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48078086 win 65335
14:55:21.172844 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48081006 win 65335
14:55:21.173144 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48083926 win 64605
14:55:21.185225 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48083926 win 65335
14:55:21.572333 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48116046 win 65335
14:55:21.585313 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.585315 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.585414 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.585417 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.585512 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.677172 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.688654 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48151086 win 65335
14:55:21.688657 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48158386 win 65335
14:55:21.688757 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48158386 win 65335
14:55:21.780613 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48170066 win 65335
14:55:21.883755 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48170066 win 65335
14:55:21.986998 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48170066 win 65335
14:55:22.090639 IP 10.0.0.1.56109 > apollo.fileburst.net.80: . ack 48170066 win 65335

All Event times change with Daylight Savings time

With the time change associated with daylight savings time (March 8 2008) all my event times were changed by one hour. EG: events that were 8:45 am are now 7:45 am. I have tried using Time machine to restore to pre March 8 status,but an adjustment takes place and the events remain 1 hour ahead. I have looked through the discussions pages and don't even see the issue identified. I have looked through the menu and preference items and find nothing to help.
I am surprised not to find this a front page topic today, March 9 2008.
Can anyone offer some help ?
Bill Mullen

Michael,
I never have changed time zones. Are you suggesting I should have time zone support enabled ?
I just tried turning on Time Zone Support, then restoring my calendar using Time machine. No change here.
As I mentioned earlier, this same problem occurred in the fall (although I don't remember which way the event times moved), this time they moved forward. At the Fall change I was using a Mac G4, which I used as a target to build this machine. The only thing I can think of that makes me unique (although I'm not in that small of a group) is that I have altered one of the files in iSync to allow iSync to sync calendar events with iCal. The syncing has always worked OK.
Right now I'm leary of attempting to do anything with iSync. I'm also finding it difficult to believe I'm not one of 10,000 people experiencing the same problem, but I don't see any other posts.
I found a time zone in south america which returns my times to the correct figure, with time zone support enabled, but that looks like a deeper hole to dig out of.
Still stuck,
Bill

Event time issue - IPS 4240, v5.0, VMS.

Similar Messages

Maybe you are looking for