Bug #2001
closedHandling of unsolicited DNS responses.
Description
When a DNS response is received that has a different ID there are 2 issues:
- An unsolicited DNS response event is not raised.
- The legitimate response, received after the unsolicted response is not logged.
The first issue is the unsolicted response caused a new transaction to be created without incrementing the transaction ID first, which meant we had 2 transactions with the same ID causing the event to not be recorded correctly.
The second issue is due to transactions which are not complete not being fully logged if a more recent transaction has been fully logged - other protocols that can have overlapping transactions such as DNP3 can also run into this issue.
Updated by Jason Ish almost 8 years ago
- Status changed from Assigned to Closed
- Target version changed from 70 to 3.2.1
Fix merged, see: https://github.com/inliniac/suricata/pull/2493 and https://github.com/inliniac/suricata/pull/2486.