Unreplied DNS queries not logged when flow is aged out
If a DNS query is not followed by a response before the flow is timed out, the DNS transaction is not logged at all. I was wondering if there's a way to trigger the tx logging before the flow is flushed out.
This is observed with suricata 3.0RC1.
Updated by Jason Ish about 6 years ago
- Status changed from Assigned to Closed
- Target version changed from 70 to 3.1.1
The DNS query is now logged after the query is complete instead of waiting for the reply. So a missing reply will no longer result in not logging the query.