Re: Use Rpcdump for Intrusion detection

Jean-Baptiste Marchand <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]>
* lee forrest <[email protected]> [01/01/70 - 01:00]:

> Netstat -ao shows which PID's are opening ports on your machine however if 
> you really want to check the rpc end point mapper database , use 
> RPCDUMP.EXE.
> So you can quickly check which servers are registered on your machine or a 
> target machine and which interfaces.

rpcdump will only return RPC services that have registered with the
endpoint mapper.

If you really want to check if a given port is used by a dce rpc
service, you must use the ifids program:

http://www.hsc.fr/ressources/presentations/hivercon03/img59.html


Demonstration of ifids against RPC services listening on named pipes
(SMB transport):

http://www.hsc.fr/ressources/presentations/sambaxp2003/slide24.html


Open-source versions of rpcdump and ifids (written by Todd Sabin) are
available at:

http://www.bindview.com/Support/RAZOR/Utilities/Windows/rpctools1.0-readme.cfm


Jean-Baptiste Marchand
-- 
[email protected]
HSC - http://www.hsc.fr/
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.