Added by Christie Bunlon about 12 years ago. Updated about 12 years ago.
Description
I am trying to detect DNS Tunneling.
For this I use the DNS logger in Suricata 2.0.
But when TXT answers have lot of data, the DNS logger say '<no data>'.
Files
| dns.log (45 KB) dns.log | Log DNS trafic | Christie Bunlon, 04/01/2014 04:06 AM | |
| 90dns22.pcap (30.7 KB) 90dns22.pcap | DNS Tunneling Trafic | Christie Bunlon, 04/01/2014 04:06 AM |
Sorry is not the parser but the DNS logger.
I think this is only matter of extending the dns loggers. If it turns out to be more involved it will likely go into 2.1.
Please test: https://github.com/inliniac/suricata/pull/967
I have tested it but it seems still not working,saying again <no data> with 90dns22.pcap
I'm not getting any 'no data' with this branch, are you sure you tested the branch from pull request 967?
Sorry, i made a mistake with my suricata.
It's logging correctly the answers now.
Thank you for your help. You can close the ticket. :)