Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity449Rlogin Malformed DataBase Event:Details:Response:Affected:RLOGIN_INVALID_CLI_INITSomething that doesn’t look like a user name was passed to rlogin as the user name.If seen in sufficient volume or variation, audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targets.False Positives: None known.ReferencesRlogin SpecificationsRlogin Malformed DataBase Event:Details:Response:Affected:RLOGIN_INVALID_CLI_LOGIN_FIELDSomething that doesn’t look like a user name was passed to rlogin as the user name.If seen in sufficient volume or variation, audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targets.False Positives: None known.ReferencesRlogin SpecificationsRlogin Malformed DataBase Event:Details:Response:Affected:RLOGIN_INVALID_SER_LOGIN_FIELDThe user name on the remote host (or server) provided by the client did not conform to the RFC.If seen in sufficient volume or variation, audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targets.False Positives: None known.ReferencesRlogin SpecificationsRlogin Malformed DataBase Event:Details:Response:Affected:RLOGIN_INVALID_SERVER_INITThe server sent back something that doesn’t look like the start of a rlogin session whenestablishing a session.If seen in sufficient volume or variation, audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targets.False Positives: None known.ReferencesRlogin Specifications