I am busy analyzing the alarm “Windows Locator Service Overflow” with in our network. The signature says that it will trigger when with the following parameters
8 - MinMatchLength = 2000
11 - ServicePorts = 139,445
I would like to see an example of when this alarm has triggererd and then corilate that with the “iplog” capture that has been taken during the same period.
Can anyone on the list tell me what the ethereal or tcpdump filter should look like in order to filter these packets to the display?
Would eth.len > 2000 work?
