This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Re; DOS MSDTC attempt - ID 1408

Is anybody else seeing a massive number of alerts logged for this rule in ASL 5?

DOS MSDTC attempt - ID 1408

I currently have more than 14,000 hits for the rule.

This thread was automatically locked due to age.

Parents

0 William Warren over 21 years ago

If your winder boxes are fully patched then this is a false positive:
http://archives.neohapsis.com/archives/snort/2002-05/0162.html
Cancel
Vote Up 0 Vote Down

Cancel
0 Manctastic over 21 years ago in reply to William Warren

Yep all fully patched and set to update and install automatically.

Risky, but not as risky as not being patched because i have to rely on my users to install the patch [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 eFrisky over 21 years ago in reply to Manctastic

I would hazard a guess that it's BitTorrent which is causing these false alarms (DOS MSDTC attempt - ID 1408), as I'm also running BT and I've seen these same IP notifications.
If you're not forwarding port 3372 (listening port for the Microsoft Distributed Transaction Service Coordinator) from the external interface to a client on your LAN running MSDTC, you should be fine!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 eFrisky over 21 years ago in reply to Manctastic

I would hazard a guess that it's BitTorrent which is causing these false alarms (DOS MSDTC attempt - ID 1408), as I'm also running BT and I've seen these same IP notifications.
If you're not forwarding port 3372 (listening port for the Microsoft Distributed Transaction Service Coordinator) from the external interface to a client on your LAN running MSDTC, you should be fine!
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data