Snort mailing list archives
Re: Does Signature exist alert on DNS queries to a nameserver.
From: Zultan <zultan () mad scientist com>
Date: Mon, 06 Mar 2006 20:59:14 +0000
Here's the basic syntax. Note the hex number between the pipes. It is the count of the number of following ASCII bytes. For example, freebeertoday.com would be |0d|freebeertoday|03|com alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"amazon.com DNS query"; content:"|06|amazon|03|com"; nocase;) Sensor placement is critical for this to work. The senosr must be able to see the desktop ask its nameserver(s). Zultan
----- Original Message ----- From: "Jacob, Raymond A Jr" <raymond.jacob () navy mil> To: snort-users () lists sourceforge net Subject: [Snort-users] Does Signature exist alert on DNS queries to a nameserver. Date: Mon, 6 Mar 2006 13:14:03 -0500 Does a signature exist to detect queries for hosts in specific domains to a specific name server? For example queries for amazon.com that are resolved by our local dns. Thank you Raymond
-- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/ ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Does Signature exist alert on DNS queries to a nameserver. Zultan (Mar 06)