Project

General

Profile

Actions

Bug #4135

open

dns: response only udp not detected as dns

Added by Jason Ish 10 months ago. Updated 10 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

If only a DNS response is seen on a UDP session it will not be detected and parsed as DNS with the default configuration.

Enabling stream.midstream does allow it to be picked up, but this is just an unintended side affect as stream.midstream is really a TCP setting. Likewise, enabling async streams allows this scenario to work for TCP DNS, but doesn't affect UDP DNS.

My feeling is that this should just work with the default configuration.


Related issues

Related to Optimization #2272: Analyze DNS response if query is not presentAssignedJason IshActions
Actions #1

Updated by Victor Julien 10 months ago

  • Assignee set to OISF Dev
  • Target version set to 7.0rc1

Depending on complexity of the solution we can consider backports as well.

Actions #2

Updated by Victor Julien 10 months ago

Actions

Also available in: Atom PDF