Signature Detail
Short Name |
MS-RPC:EVASION:LARGE-FRAG-2 |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
MS-RPC |
Release Date |
2006/04/07 |
Update Number |
1213 |
Supported Platforms |
idp-4.0 - idp-5.0, isg-3.0+ |
MS-RPC: Evasion Technique (4)
This signature detects packets containing known evasion techniques that affect the SMB, DCE RPC, and MS RPC protocols. These packets should not be seen in normal traffic and indicate attempts to evade network defense systems by sending invalid, out of order, or heavily fragmented communication. Due to potential false-positives in some older MS-RPC services, this signature should only be used to inspect traffic going to and from the Internet on WAN links. This signature should NOT be used to monitor traffic between internal servers/clients on a LAN or inter-office WAN.
Extended Description
None