Rpc Analysis Configuration - Enterasys Intrusion Prevention System Manual

Configuring the Protocol Analysis Module

RPC Analysis Configuration

The RPC Analysis feature uses several different techniques:
• The Network Sensor looks for RPC traffic that is attempting to connect to a portmapper
(rpcbind) and issuing a SET, GETPORT, DUMP, or REDIRECT command. All UDP and TCP
traffic on port 111 or ports in the 3277x range (Solaris sometimes starts RPC services higher
up) are checked for RPC traffic. When such traffic is observed, one of the PMAP events is
generated.
To cause the Network Sensor to attempt an RPC decode of every packet it sees, regardless of
destination port, enable the any-port property. However, this property should only be enabled
when your specific Network Sensor implementation has spare CPU cycles. Enabling any-port
helps find intruders who are trying to go directly to various RPC ports without conversing
with the portmapper service first.
By default, only inbound traffic to the protected network is monitored. To enable RPC
monitoring of all traffic, disable the inbound-only property.
• The Network Sensor also inspects packets going to an RPC service for IDS evasion techniques
and DoS attacks. These attacks use inherent obfuscations within the RPC protocol. RPC
analysis converts the RPC payload into the correct format for the signatures to match. If you
enable the verbose property, the sensor will also log RPC events when certain evasions occur.
For more details about this particular evasion and DoS attack, please read Randy Taylor's
explanation, which can be found in the Whitepapers section of the Dragon web site:
https://dragon.enterasys.com
• You can configure the sensor to watch only for specific RPC traffic, by configuring ignore and
log rules in the RPC Log Elements area of the Analysis Settings window. These rules require
that you enter the RPC program number.
Procedure
To configure RPC Analysis settings:
1. Click the Network Policy View icon and the Network Policies tab.
2. Expand the tree by clicking the expansion symbols and select the desired custom policy name.
The modules for that policy are displayed in the tree.
3. Click the Protocol Analysis Module in the tree.
2-74 Creating Network Sensor Policies