Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Sig 3314 towards domain controller

The Windows Locator Service Overflow trigger is going off... the target is a domain controller. I'm looking at the event in CTR and the information field looks a little funny:

Event ID: 3314

Sub ID: 0

Information:[from-victim= L #SMB &,&a IWUODR.DDR

Any ideas on this?

2 REPLIES
New Member

Re: Sig 3314 towards domain controller

Could you set IPlog for this signature and capture the traffic?

This, of course, only if you are running a 4.1 sensor.

If you can, please email it to anthall@cisco.com

Thanks

New Member

Re: Sig 3314 towards domain controller

sure.. thanks

104
Views
0
Helpful
2
Replies
CreatePlease login to create content