Project

General

Profile

Actions
Copy link

Bug #7279

open

dns: protocol detection is not strict enough

Added by Philippe Antoine about 1 month ago. Updated 30 days ago.

Status:
In Review
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

From https://github.com/OISF/suricata/pull/11794 and TLPR pcaps from QA showing the deviation

Related issues 1 (1 open — 0 closed)

Related to Suricata - Bug #7228: dns: no data logged, and no events with udp corrupt additional recordIn ReviewJason IshActions
Actions
Copy link
 #1

Updated by Philippe Antoine about 1 month ago

  • Related to Bug #7228: dns: no data logged, and no events with udp corrupt additional record added
Actions
Copy link
 #2

Updated by Philippe Antoine about 1 month ago

  • Subject changed from dns: custom protocol data exfiltration traffic on port 53 detected as DNS with later app-layer parser error to dns: protocol detection is not strict enough

It accepts as DNS custom protocol data exfiltration traffic on port 53 with later app-layer parser error on TLP pcap

Actions
Copy link
 #3

Updated by Philippe Antoine 30 days ago

  • Status changed from New to In Review
Actions
Copy link

Also available in: Atom PDF