Patent ID: 9055094
Filing Date: 2015-06-09
Classification: H04L

Abstract:
1. A method performed in a processor of an intrusion detection/prevention system (IDS/IPS), for checking for valid packets in a server message block (SMB) named pipe in a communication network, comprising: receiving, in a processor configured as an IDS/IPS, a fragment/segment, and determining a kind of application of a target of the fragment/segment in response to receiving the fragment/segment; separating, in the IDS/IPS, fragments/segments with a same multiplex ID (MID) as part of a same SMB transaction command from fragments/segments with a different MID, the MID being in the SMB frame header, all for fragments/segments in the same SMB named pipe; accessing a reassembly table that indicates the kind of application to determine whether the kind of application separates SMB transaction commands based on MID; and responsive to a determination that the kind of application of the target separates SMB transaction commands based on MID, processing, in the IDS/IPS, the same SMB transaction command with the same MID as being in a distinct SMB transaction command instead of with the fragments/segments with the different MID.