Snort mailing list archives

Incomplete RPC segment


From: "IntegPatchMgr" <IntegPatchMgr () infosys com>
Date: Thu, 25 Mar 2004 10:19:38 +0530

Hi,

I have setup like this

---Internet--------Firewall ---------
DMZ-----------------------Microsoft ISA Proxy Server ( 204.3.247.6)
                    |
                    |    
                    |
 SNORT IDS -------------------- BlueCoat Proxy Server  ( 172.21.34.55) 



We have configured the firewall rulebase like

Microsoft ISA Server  ----> Internet  ----> http & Https
Bluecoat Proxy Server ---> Microsoft ISA Server   ---> http & https.


Problem,
We are getting lot of alerts from SNORT system as shown below 


[snort] (spp_rpc_decode) Incomplete RPC segment 2004-03-19 18:11:29
204.3.247.6:80 172.21.34.55:32771 

Any pointes ?  

Regards
Shivabasu

Have you visited http://sampark.ad.infosys.com/INTEG



Current thread: