Re: Windows RPC Dcom overflow

bizsnatch · ‎10-21-2003

Has anyone discovered any benign triggers for this signature yet? It's triggered a few times on my network and the machines are clean.

thanks,

biz

anthall · ‎10-21-2003

Which version are you running? Which signature is firing (subsig)?

bizsnatch · ‎10-21-2003

ID: 3327 Sub ID: 0

Sensor Info:

Cisco Systems Intrusion Detection Sensor, Version 4.1(1)S57

lwierenga · ‎10-21-2003

Are these systems triggering the alarms servers, workstations or both? Load-balancing between servers may cause this alarm to fire. I have heard that SMS agent under certain circumstances will fire a false-positive. Need more information.

bizsnatch · ‎10-22-2003

They are triggering from workstation to server. Only 3 at this point.

klwiley · ‎10-22-2003

Could you set the sensor up to capture the trigger packet? When you get one that you beleive is a false positive we can then help extract that alarm and we will be able to analyze what is causing it.

You can contact Tony Hall at anthall@cisco.com when you have a suspect.

bizsnatch · ‎10-22-2003

Sure will... thanks.