Symantec™ Security Gateways Reference Guide - Sawmill

452 IDS eventsSuspicious activityRPC Malformed DataBase Event:Details:Response:Affected:RPC_PACKET_OVERRUNExtra data was sent after a valid RPC packet. This may be a buffer overflow attempt.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.ReferencesRPC SpecificationsRPC Malformed DataBase Event:Details:Response:Affected:RPC_RUNT_PACKETA RPC packet length was sent in an RPC packet header that was shorter than the length of a validRPC header.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.ReferencesRPC SpecificationsRPC Malformed DataBase Event:Details:Response:Affected:RPC_SHORT_PAYLOADThe end of the valid RPC packet was reached prior to the end of the transport packet. This is inviolation of the RFC.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.ReferencesRPC SpecificationsRSH Auth FailureBase Event:Details:Response:RSH_LOGIN_FAILEDAn rsh authentication attempt was made that resulted in failure.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.