Next: Target Based
Up: DCE/RPC 2 Preprocessor
Previous: DCE/RPC 2 Preprocessor
For proper functioning of the preprocessor:
- Stream session tracking must be enabled, i.e. stream5. The
preprocessor requires a session tracker to keep its data.
- Stream reassembly must be performed for TCP sessions. If it is decided
that a session is SMB or DCE/RPC, either through configured ports, servers or
autodetecting, the dcerpc2 preprocessor will enable stream reassembly
for that session if necessary.
- IP defragmentation should be enabled, i.e. the frag3
preprocessor should be enabled and configured.