DCE2_EVENT__SMB_BAD_NEXT_COMMAND_OFFSET

[dcanady55]

Hello,

Does anyone know if this is still considered a bug in 7.0 within the FMC? I'm seeing a lot of these events being triggered from folks copying to and from our share drive. I'm not sure if whitelisting is the best way to go or if there's another route to take. Thanks in advance for any feedback.

[Milos_Jovanovic · Accepted solution]

Hi @dcanady55,

I'm not aware of any bug regarding this specific signature. There was a bug CSCvp54541 about missing signature, but that was very long time ago. It really depends what SMB server are you using, and how does it work in general. You can see more details about specific IPS rule here.

If you are confident that this is regular traffic, then you can suppress this one.

Kind regards,

Milos