Project

General

Profile

Actions

Feature #2198

open

Extend the DNS parser to accept dns_response keyword in signatures

Added by Anonymous about 7 years ago. Updated about 5 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

For A and AAAA records it would be interesting to match on the IP received from the DNS resolver.
In particular this could be useful to check for potentially sink-holed domains.


Related issues 1 (1 open0 closed)

Related to Suricata - Feature #2448: Add additional buffers for DNS ResponsesNewOISF DevActions
Actions

Also available in: Atom PDF