Project

General

Profile

Actions

Feature #121

open

Alert on domain name look up, capture traffic for corresponding IP

Added by Dave Smith over 11 years ago. Updated over 2 years ago.

Status:
New
Priority:
Low
Target version:
Effort:
medium
Difficulty:
medium
Label:

Description

It'd be handy to have the ability to capture traffic involving an IP address found in DNS responses for a known bad domain. As far as I know, no other IDS product does this.

As an example, say I have an IDS sensor at my border router. A workstation on my network looks up badguy.com, and receives a DNS response for address 4.5.6.7.

As I know badguy.com is a botnet command and control host, and that any communication with 4.5.6.7 will therefore be of security interest, I want to have all traffic involving that IP address recorded (possibly for x minutes after the DNS request or until the IP in the DNS response changes) to see what data has gone out to that command and control host, especially if it contains data that will help me quickly identify the infected workstation, that I can use to find the infected box and clean it up.


Related issues

Related to Feature #1005: conditional logging: controlling what gets loggedAssignedVictor JulienActions
Actions #1

Updated by Victor Julien over 10 years ago

  • Assignee set to Anonymous
Actions #2

Updated by Victor Julien about 9 years ago

  • Target version set to TBD

I guess such a thing would start with a DNS protocol decoder.

Actions #3

Updated by Andreas Moe over 6 years ago

Dont we do DNS protocol decoding? seeing that we can log DNS activity? Or is this more of a scenario where we could write "alert dns..."

Actions #4

Updated by Victor Julien about 3 years ago

  • Effort set to medium
  • Difficulty set to medium
Actions #5

Updated by Andreas Herz over 2 years ago

  • Assignee set to Community Ticket
Actions #6

Updated by Victor Julien 10 months ago

  • Related to Feature #1005: conditional logging: controlling what gets logged added
Actions

Also available in: Atom PDF