Project

General

Profile

Actions

Bug #5444

closed

dns: allow dns messages with invalid opcodes

Added by Jason Ish over 1 year ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Current a DNS message won't be detected as DNS if the opcode is considered invalid (greater than 7). We should probably accept any opcode, and then use rules to alert on invalid opcodes.

Research: Will this detect too much non DNS as DNS?


Files

opcode8.pcap (522 Bytes) opcode8.pcap Jason Taylor, 07/19/2022 07:44 PM

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #5550: dns: allow dns messages with invalid opcodes (6.0.x backport)ClosedJeff LucovskyActions
Actions

Also available in: Atom PDF