diff --git a/scripts/base/protocols/rdp/main.zeek b/scripts/base/protocols/rdp/main.zeek index 63b95b2835..5d95fa84fc 100644 --- a/scripts/base/protocols/rdp/main.zeek +++ b/scripts/base/protocols/rdp/main.zeek @@ -204,6 +204,10 @@ event rdp_client_network_data(c: connection, channels: ClientChannelList) c$rdp$client_channels[i] = gsub(channels[i]$name, /\x00+$/, ""); } + if ( |channels| > 31 ) { + Reporter::conn_weird("RDP_channels_requested_exceeds_max", c, fmt("%s", |channels|)); + } + } event rdp_gcc_server_create_response(c: connection, result: count) &priority=5