Project

General

Profile

Optimization #2272

Analyze DNS response if query is not present

Added by Chris Knott over 1 year ago. Updated about 2 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

A DNS event should be logged in the eve.json file if the DNS response is available in the packet stream only (meaning that the DNS query to the response is missing). At the moment DNS queries are always generating a DNS event entry. DNS responses are only generating an entry if the appropriate DNS query is present in the packet stream. This behavior is the same in the C and in the RUST implementation of the DNS plugin.
The test PCAP attached:
dns.pcap: 2 packets, a DNS query and the corresponding response; generating 2 DNS event entires in the eve.json file
dnsquery.pcap: Only the query contained in dns.pcap; generating 1 DNS even entry in the eve.json file
dnsresponse.pcap: Only the response contained in dns.pcap; generating 0 DNS event entries in the eve.json file (should generate 1 entry)


Files

dns.pcap (208 Bytes) dns.pcap Chris Knott, 11/16/2017 03:47 PM
dnsquery.pcap (108 Bytes) dnsquery.pcap Chris Knott, 11/16/2017 03:47 PM
dnsresponse.pcap (124 Bytes) dnsresponse.pcap Chris Knott, 11/16/2017 03:47 PM

Related issues

Related to Support #2309: SuriCon 2017 brainstormNew12/01/2017Actions
Related to Feature #2278: failing betterNew11/20/2017Actions
Related to Bug #2146: DNS answer not logged with eve-logAssignedActions
Blocked by Feature #2572: extend protocol detection to specify flow directionClosedActions

History

#1

Updated by Andreas Herz over 1 year ago

  • Assignee set to Anonymous
  • Target version set to TBD

Is this something we should change or make it an config option?

#2

Updated by Chris Knott over 1 year ago

My suggestion would be that single sided DNS should work if, in the "stream" section of the configuration, "midstream" and/or "async-oneside" is "true". I was talking to Jason during Suricon ... he meant that the problem seems to be in stream/flow handling and not in the DNS plugin itself (the DNS plugin does not see the DNS packet if the DNS response is sent without the DNS query)

#3

Updated by Victor Julien over 1 year ago

The biggest problem is the protocol detection currently. A stream where we see only the reply side would not be properly detected.

#4

Updated by Victor Julien over 1 year ago

#5

Updated by Victor Julien about 1 year ago

#6

Updated by Victor Julien 8 months ago

  • Related to Bug #2146: DNS answer not logged with eve-log added
#7

Updated by Andreas Herz about 2 months ago

  • Assignee set to Community Ticket
#8

Updated by Victor Julien about 2 months ago

  • Blocked by Feature #2572: extend protocol detection to specify flow direction added
#9

Updated by Victor Julien about 2 months ago

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to Jason Ish

When protocol detection for midstream and async is improved, the dns parser should be updated/tested to handle this.

Also available in: Atom PDF