Re: [Snort-sigs] Not sure I understand "RPC AMD TCP pid request"..

On Fri, May 02, 2003 at 03:55:54PM -0700, Tom Arseneault wrote:
> alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD TCP pid request"; flow:to_server,established; content:"|00 04 93 F3|"; content:"|00 00 00 09|"; distance:4; within:4; classtype:rpc-portmap-decode; sid:1953; rev:1;)

> What I don't understand is why the destination port is 500(tcp), everything

The port is NOT 500, the port is "any port from 500 and up." amd has its own service (300019) that generally runs on ports above 500.

Port 111 is for portmap. In this rule, we are looking for the pid request on the amd service, NOT the portmap request for where this service is running.

> I did a quick web search and was unable to find any indications that this

Well, its very easy.

1. setup a system that uses AMD.
2. on another system, run "amq -h system.running.amd -p -T"

-brian

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek