Security Incidents mailing list archives
Re: DNS zone transfer
From: Fernando Cardoso <fernando () BN PT>
Date: Mon, 4 Sep 2000 10:45:08 +0100
[...]
The snort filter for zone transfers picks up _any_ connections to TCP port 53. Whether or not they actually treid to transfer a zone after making that connection determines what is logged.
Actually no. The filter from Whitehats is has follows: alert TCP $EXTERNAL any -> $INTERNAL 53 (msg: "IDS212/dns-zone-transfer"; content: "|01 00 00 01 00 00 00 00 00 00|"; flags: AP; offset: 2; depth: 16;) Based on the post from James Hoagland to the snort-users list, a more precise rule should be something like this: alert TCP $EXTERNAL any -> $INTERNAL 53 (msg: "IDS212/dns-zone-transfer"; content: "|FC|"; flags: AP; offset: 13;) Cheers Fernando _________________________________________________________ Fernando Cardoso Phone: +351 21 7982186 Network Administrator Fax: +351 21 7982185 National Library E-mail: fernando () bn pt Portugal PGP ID: 28551CB8
Current thread:
- DNS zone transfer Fernando Cardoso (Sep 01)
- Re: DNS zone transfer James Hoagland (Sep 02)
- Re: DNS zone transfer H D Moore (Sep 03)
- <Possible follow-ups>
- Re: DNS zone transfer Fernando Cardoso (Sep 04)
- Re: DNS zone transfer Fernando Cardoso (Sep 04)