What is SRV in MS RPC and what should I know about it?
In this MSDN article on interface registration flags, the flag description RPC_IF_ALLOW_LOCAL_ONLY
talks about some object called SRV:
... When this interface flag is registered, the RPC runtime rejects calls made by remote clients .... RPC only accepts ncacn_NP calls if the call does not originate from an SRV ...
I've looked at RFC 2782 and still don't get it. What is SRV in the first place, and how can I tell if calls are coming from it or in some other way?
a source to share
SRV.SYS is an SMB server driver. The article says that named pipe requests are allowed as long as they do not belong to that driver (i.e., unless they originate from somewhere other than the local machine).
This makes sense since you are registering your server to only accept local connections. You don't want named connections to connect over the network.
This page details the use of named pipes over SMB.
a source to share