Wireshark · Ethereal-users: Re: [Ethereal-users] DCOM exception

[Ulf Lamping <ulf.lamping@xxxxxx>]

RODRIGO MARTINEZ wrote:
>  
>  Hi , I have a doubt about the packet IREMUNKNOW2 interface.
> I have DCOM comunication, but I dont know if this packet must be part of this comunication.
>  
>  
> I need comunicate 2 servers but when a pix up his filters, the comunication doesn't work.
> Some white papers said that I need just open the 6100 to 6200  ports, but the web aplication hang.
>  
> I ask about this packet IREMUNKNOW2  because this one dont include in this range port.
>  
> Thanks in advance to any idea.
>  
>   
Your mail is pretty hard to understand.

DCOM uses DCE/RPC. DCE/RPC uses the endpoint mapper on port 135. The 
endpoint mapper mechanism will negotiate the "real" data transfer port 
(which could be any possible port AFAIK).

I don't know about a white paper telling about ports 6100 to 6200 only.

Basically if you want to use a port based filter with DCOM you're simply 
out of luck.

Regards, ULFL