From 8835a360cad78feabb17be6802e43fe7aa763fa4 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 17 Aug 2010 18:25:45 +1000 Subject: s4-rpcserver: log unknown RPC calls at debug level 3 This was added as we are occasionally getting an encrypted unknown netlogon call, and I'm having trouble looking at it in wireshark --- source4/rpc_server/dcerpc_server.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'source4/rpc_server') diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c index f2edbf74c6..9103923b3e 100644 --- a/source4/rpc_server/dcerpc_server.c +++ b/source4/rpc_server/dcerpc_server.c @@ -978,6 +978,12 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call) /* unravel the NDR for the packet */ status = context->iface->ndr_pull(call, call, pull, &call->r); if (!NT_STATUS_IS_OK(status)) { + if (call->fault_code == DCERPC_FAULT_OP_RNG_ERROR) { + /* we got an unknown call */ + DEBUG(3,(__location__ ": Unknown RPC call %u on %s\n", + call->pkt.u.request.opnum, context->iface->name)); + dump_data(3, pull->data, pull->data_size); + } return dcesrv_fault(call, call->fault_code); } -- cgit