MS/DCE RPC?

[ciscomeo]

What's the best way of adding MS/DCE RPC protocol in your protocol database? I notice it uses a lot of source port.

Any suggestions..?

Thanks,

 

[mahaprabhu]

If they are contiguous sequences of ports, you can use the port aggregation feature in Sniffer Distributed.
MP

 

[ciscomeo]

Hi! Can you further elaborate? I am a new user in Sniffer and I don't know how to use the aggregation in my Sniffer Distributed.

Thanks,

 

[mahaprabhu]

Prerequisite - You should be on Sniffer Distributed 4.3 or greater.

Steps -
1. Go into Tools | Protocols Options,

2. Enter port ranges in UDP and / or TCP tabs and associate an intuitive protocol name -like Dce-Rpc.

3. Open the capture file & select Protocol Distribution tab or click Monitor | Protocol Options, if you're monitoring real time traffic

4. Now, when you view the protocol distribution charts, the packets with the TCP / UDP port nos. specified in step 2, should show up under the descriptive name you chose.