[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[LDM #ITQ-479405]: Sun ONC RPC Multiple Fragments in One Packet Evasion Alert by Firewalls for LDM

This archive contains answers to questions sent to Unidata support through mid-2025. Note that the archive is no longer being updated. We provide the archive for reference; many of the answers presented here remain technically correct, even if somewhat outdated. For the most up-to-date information on the use of NSF Unidata software and data services, please consult the Software Documentation first.

  • Subject: [LDM #ITQ-479405]: Sun ONC RPC Multiple Fragments in One Packet Evasion Alert by Firewalls for LDM
  • Date: Thu, 14 Jul 2016 09:42:15 -0600
Ben,

Well, because you're seeing these messages on connections from your LDM to ours 
and because I know that our LDM-s don't do anything nefarious, I suspect that 
the warning threshold is simply set too low on your intrusion detection system 
(i.e., that multiple ONCRPC fragments are allowed in a single packet even 
though this can be used for nefarious purposes).

> We are seeing this on both jetstream.msudenver.edu and weather.msudenver.edu. 
> Both are reaching out to you guys exclusively but I do not manage this server 
> so I’m unsure about what is going on with the server internally other than 
> your software is running on it.


Regards,
Steve Emmerson

Ticket Details
===================
Ticket ID: ITQ-479405
Department: Support LDM
Priority: Normal
Status: Closed
===================
NOTE: All email exchanges with Unidata User Support are recorded in the Unidata 
inquiry tracking system and then made publicly available through the web.  If 
you do not want to have your interactions made available in this way, you must 
let us know in each email you send to us.