Project

General

Profile

Actions

Feature #2198

open

Extend the DNS parser to accept dns_response keyword in signatures

Added by Anonymous about 4 years ago. Updated almost 2 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

For A and AAAA records it would be interesting to match on the IP received from the DNS resolver.
In particular this could be useful to check for potentially sink-holed domains.


Related issues

Related to Feature #2448: Add additional buffers for DNS ResponsesNewOISF DevActions
Actions #1

Updated by Andreas Herz about 4 years ago

  • Tracker changed from Bug to Feature
  • Target version changed from 70 to TBD

Since you assigned yourself, do you want to submit that?

Actions #2

Updated by Anonymous about 4 years ago

Andreas Herz wrote:

Since you assigned yourself, do you want to submit that?

Yes, it is in the pipeline.
Do you want me to focus on a Rust implentation?

Actions #3

Updated by Andreas Herz about 4 years ago

Depends on what you prefer, IMHO it would be nice to have it in Rust.

Actions #4

Updated by Jason Ish over 3 years ago

  • Related to Feature #2448: Add additional buffers for DNS Responses added
Actions #5

Updated by Andreas Herz over 2 years ago

  • Assignee changed from Anonymous to Stian Bergseth
Actions #6

Updated by Victor Julien almost 2 years ago

  • Assignee changed from Stian Bergseth to Community Ticket
Actions

Also available in: Atom PDF