Project

General

Profile

Actions

Feature #2970

closed

DNS: Parse and extract SOA app layer data from DNS packets

Added by Konstantin Klinger over 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Protocol

Description

At the moment the DNS parser gives you "SOA" as rrtype, but the related metadata of those SOA records/DNS packets are missing. In the attached pcap you can find the current output.

I would expect something like this (equivalent to the content in Wireshark output):
Answers
suricon.net: type SOA, class IN, mname ns1.siteground199.com
Name: suricon.net
Type: SOA (Start Of a zone of Authority) (6)
Class: IN (0x0001)
Time to live: 21599
Data length: 50
Primary name server: ns1.siteground199.com
Responsible authority's mailbox: root.siteground199.com
Serial Number: 2018092604
Refresh Interval: 86400 (1 day)
Retry Interval: 7200 (2 hours)
Expire limit: 3600000 (41 days, 16 hours)
Minimum TTL: 86400 (1 day)


Files

soa_record_eve.json (5.54 KB) soa_record_eve.json eve json output for processing the pcap Konstantin Klinger, 05/07/2019 11:27 AM
soa_record.pcap (719 Bytes) soa_record.pcap pcap with three SOA record queries and answers Konstantin Klinger, 05/07/2019 11:27 AM
Actions #1

Updated by Andreas Herz over 2 years ago

  • Assignee set to Community Ticket
  • Target version set to TBD
Actions #2

Updated by Victor Julien over 1 year ago

  • Label Protocol added
Actions #3

Updated by Simon Dugas over 1 year ago

I started looking into this: https://github.com/OISF/suricata/pull/4830

Actions #4

Updated by Victor Julien over 1 year ago

  • Status changed from New to In Review
  • Assignee changed from Community Ticket to Simon Dugas
  • Target version changed from TBD to 6.0.0beta1
Actions #5

Updated by Victor Julien about 1 year ago

  • Target version changed from 6.0.0beta1 to 7.0rc1
Actions #6

Updated by Victor Julien about 1 year ago

  • Status changed from In Review to Closed
  • Target version changed from 7.0rc1 to 6.0.0rc1
Actions

Also available in: Atom PDF