Cisco Cisco Firepower Management Center 4000

See the following sections for more information:

Protection

Global DCE/RPC preprocessor options control how the preprocessor functions. Except for the 

 option, modifying these options could have a negative impact on performance 

or detection capability. You should not modify them unless you have a thorough understanding of 
the preprocessor and the interaction between the preprocessor and enabled DCE/RPC rules. In 
particular, make sure that the 

 option and 

 option are 

greater than or equal to the depth to which the rules need to detect. For more information, see 

 and 

.

If no preprocessor rule is mentioned, the option is not associated with a preprocessor rule.

When 

 is selected, specifies the maximum DCE/RPC fragment length allowed 

from 1514 to 65535 bytes. The preprocessor truncates larger fragments for processing purposes to 
the specified size before defragmenting but does not alter the actual packet. A blank field disables 
this option.

When 

 is selected, 0 disables this option, or 1 to 65535 bytes specifies a 

minimum number of fragmented DCE/RPC bytes and, if applicable, segmented SMB bytes to queue 
before sending a reassembled packet to the rules engine. A low value increases the likelihood of 
early detection but could have a negative impact on performance. You should test for performance 
impact if you enable this option.

Specifies whether to defragment fragmented DCE/RPC traffic. When disabled, the preprocessor still 
detects anomalies and sends DCE/RPC data to the rules engine, but at the risk of missing exploits 
in fragmented DCE/RPC data.

Although this option provides the flexibility of not defragmenting DCE/RPC traffic, most DCE/RPC 
exploits attempt to take advantage of fragmentation to hide the exploit. Disabling this option would 
bypass most known exploits, resulting in a large number of false negatives.

Detects when the maximum memory limit allocated to the preprocessor is reached or exceeded. 
When the maximum memory cap is reached or exceeded, the preprocessor frees all pending data 
associated with the session that caused the memory cap event and ignores the rest of that session.

You can enable rule 133:1 to generate events for this option. See 

 for 

more information.