Feature #121


Alert on domain name look up, capture traffic for corresponding IP

Added by Dave Smith about 14 years ago. Updated 9 months ago.

Target version:


It'd be handy to have the ability to capture traffic involving an IP address found in DNS responses for a known bad domain. As far as I know, no other IDS product does this.

As an example, say I have an IDS sensor at my border router. A workstation on my network looks up, and receives a DNS response for address

As I know is a botnet command and control host, and that any communication with will therefore be of security interest, I want to have all traffic involving that IP address recorded (possibly for x minutes after the DNS request or until the IP in the DNS response changes) to see what data has gone out to that command and control host, especially if it contains data that will help me quickly identify the infected workstation, that I can use to find the infected box and clean it up.

Related issues 1 (1 open0 closed)

Related to Suricata - Feature #1005: conditional logging: controlling what gets loggedAssignedVictor JulienActions
Actions #1

Updated by Victor Julien about 13 years ago

  • Assignee set to Anonymous
Actions #2

Updated by Victor Julien almost 12 years ago

  • Target version set to TBD

I guess such a thing would start with a DNS protocol decoder.

Actions #3

Updated by Andreas Moe almost 9 years ago

Dont we do DNS protocol decoding? seeing that we can log DNS activity? Or is this more of a scenario where we could write "alert dns..."

Actions #4

Updated by Victor Julien almost 6 years ago

  • Effort set to medium
  • Difficulty set to medium
Actions #5

Updated by Andreas Herz about 5 years ago

  • Assignee set to Community Ticket
Actions #6

Updated by Victor Julien over 3 years ago

  • Related to Feature #1005: conditional logging: controlling what gets logged added
Actions #7

Updated by Philippe Antoine 9 months ago

I wonder if it is now possible :
One rule matches the DNS resolution to the domain, adds the ip address into a dataset
Another rule uses this dataset to trigger an alert and does conditional pcap logging


Also available in: Atom PDF