NULL sessions (IPC$ )

[Nadeem ahmed Ahmed]

Hi

Null session is not being detected by my IPS, I want to know which is the relevant signature so we could block this on IPS.

I would apprecaite if someone can share the relevant signature....so i can block null session.

Regards

Nad

[Farrukh Haroon]

Do a packet capture for your particular network and then modify then clone the existing IPS signatures related to the SMB protocol to match that particular flow.

Regards

Farrukh