Actions
Feature #2198
closed
Extend the DNS parser to accept dns_response keyword in signatures
Feature #2198:
Extend the DNS parser to accept dns_response keyword in signatures
Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:
Description
For A and AAAA records it would be interesting to match on the IP received from the DNS resolver.
In particular this could be useful to check for potentially sink-holed domains.
Actions