<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Futura Bk";
panose-1:2 11 5 2 2 2 4 2 3 3;}
@font-face
{font-family:"Futura Hv";
panose-1:2 11 7 2 2 2 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello jcifs community<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a weird problem with collecting event logs over RPC/SMB from windows servers (2003,2008)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is an ArcSight agent collecting logs remotely over 3 network hops. It uses no netbios, it’s just SMB tcp/445<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This agent attempts to seek to the last Index written. The problem is we are missing several events and we don’t want to miss any. It seems when these errors occur we get the DCERPC error and the indexing gets messed up.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The MTU of the network between agent and server is 1460, however on the hop before the server it drops to 550<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am trying to work out if fragging has a part to play<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The server says do not frag when it sends out an RPC request. It simply has to frag as most of these packets will be be bigger than 550<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is the below error actually complaining about frags?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Java.io.IOException: DCERPC pipe is no longer open<o:p></o:p></p>
<p class="MsoNormal">at jcifs.dcerpc.DcerpcPipeHandle.doSendFragment(DcerpcPipeHandle.java.63)<o:p></o:p></p>
<p class="MsoNormal">at jcifs.dcerpc.DcerpcPipeHandle.sendrecv(DcerpcHandle.java:190)<o:p></o:p></p>
<p class="MsoNormal">at com.arcsight.agent.yb.f.a(f.java:1459)<o:p></o:p></p>
<p class="MsoNormal">etc<o:p></o:p></p>
<p class="MsoNormal">etc<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-family:"Futura Hv","sans-serif";color:#221E1F">David Harris</span><span lang="EN-AU" style="color:#221E1F"><br>
</span><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">Senior Security Consultant<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">HP Enterprise Security Products<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">Hewlett-Packard Company<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">+61 408 351 760 / Mobile
<br>
<a href="mailto:bruce.coble@hp.com" title="Email Me">dharris@hp.com</a> / Email<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">410 Concord Road<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">Rhodes NSW<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="font-size:9.0pt;font-family:"Futura Bk","sans-serif";color:#221E1F">Australia 2138</span><span lang="EN-AU" style="color:#221E1F"><br>
<br>
</span><a href="http://www.hp.com/"><span style="color:blue;text-decoration:none"><img border="0" width="28" height="28" id="Picture_x0020_1" src="cid:image001.gif@01CEE20C.3D13DD40" alt="hp"></span></a><span lang="EN-AU" style="color:#221E1F"><br>
<br>
</span><span lang="EN-AU" style="font-size:9.0pt;color:#00B050">Please consider the environment before printing this email.</span><span lang="EN-AU" style="color:#221E1F">
</span><span lang="EN-AU" style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>