Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Windows RPC DCOM Overflow

On a daily basis, for as long as my logs go back (over a month), my 1811 router has been flagging %IPS-4-SIGNATURE: Sig:3327 Subsig:1 Sev:5 Windows RPC DCOM Overflow and Subsig:0 multiple times daily from all different external ip addresses on random ports to one of my inside ip on port 135.

Does anyone have any idea what is going on?

Thanks in advanced.

3 REPLIES

Re: Windows RPC DCOM Overflow

It is probably the conficker/downadup worm or a variant attempting to propagate from infected systems out on the Internet. Make sure your Windows systems are all patched and you are blocking TCP ports 135 and 445 inbound to your networks.

Hope this helps.

New Member

Re: Windows RPC DCOM Overflow

Thanks.

New Member

Re: Windows RPC DCOM Overflow

Well ,it's not actually advisable to publish netbios port (135-139,445) to the internet. Perhaps you should source limit it.

cheers

203
Views
0
Helpful
3
Replies
CreatePlease to create content