NETCONF Network Device CLI Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects network traffic on TCP port 830, which is commonly used for NETCONF (Network Configuration Protocol) sessions. The rule specifically looks for the string "<rpc" within the traffic, indicating an RPC (Remote Procedure Call) request, which is a fundamental part of NETCONF communication. This suggests an attempt to establish a CLI (Command Line Interface) session with a network device using NETCONF.