KFSensor

 

Edit Sim Std Server - SQL UDP Server

Use the Edit Sim Std Server - SQL UDP Server dialog box to add or edit a SQL UDP Server definition.

You will find a description of what are Sim Std Servers here.

This Sim Std Server emulates Microsoft's SQL Server database system's UDP service.
This UDP services is used to provide information on the location of all SQL Servers and databases known to the host server.

This modest service rose to prominence when it became the target of the infamous SQL Slammer worm.

The main MS SQL Server service runs on TCP.
See the Edit Sim Std Server - SQL Server section for more details.


There are tools that can be used to query the SQL Server UDP service.
The most popular of these tools is sqlping.

You can find this tool and more on this web site:
http://www.sqlsecurity.com/scripts.asp

The SQL UDP server responds to requests to return information on SQL databases.
Depending on the query it is sent it compiles a packet containing a collection of information.
Example:

[05]~[00]ServerName;GIMLI;InstanceName;WEBDB;IsClustered;No;Version;8.00.194;tcp;1433;np;\\GIMLI\pipe\MSSQL$WEBDB\sql\query;;

The settings of this Sim Std Server control how this packet is generated and what information is returned to the visitor.

Title

  • Name
    Each Sim Std Server requires a unique name, which is used to identify it.
  • Description
    A piece of text for notes on what the Sim Std Server aims to support
  • Default Port
    Most services have standard ports on which visitors expect to find them.
    The default port is TCP 1433.
    This is only used as a prompt during configuration of a Listen; a Sim Std Server can be set on any or many different ports.
  • Severity
    The severity level that events generated by this Sim Std Server will be given. This can be overridden as part of the Listen configuration.

Options

These settings control how the data is logged.
  • Host name
    The NetBIOS name of the SQL Server.
    If left blank the name will be taken from the NBT Settings dialog.
  • DB name
    The name of the database installation.
  • Version
    The MS SQL Server version.
  • TCP port
    The TCP port on which the man SQL Server service is running on.
    By default this is 1433, but it can be changed to any available port.

Related Topics


KFSensor On-Line Manual Contents