2.2.13 DNS

The DNS preprocessor decodes DNS Responses and can detect the following exploits: DNS Client RData Overflow, Obsolete Record Types, and Experimental Record Types.

DNS looks at DNS Response traffic over UDP and TCP and it requires Stream preprocessor to be enabled for TCP decoding.

2.2.13.1 Configuration

By default, all alerts are disabled and the preprocessor checks traffic on port 53.

The available configuration options are described below.

<#18615#><#18612#><#18612#> <#6370#>119.<#6370#> <#18615#>

ports #tex2html_wrap_inline6863#port#tex2html_wrap_inline6865#port#tex2html_wrap_inline6867#

This option specifies the source ports that the DNS preprocessor should inspect traffic.

<#18616#><#18612#><#18612#> <#6370#>120.<#6370#> <#18616#>

enable_obsolete_types

Alert on Obsolete (per RFC 1035) Record Types

<#18617#><#18612#><#18612#> <#6370#>121.<#6370#> <#18617#>

enable_experimental_types

Alert on Experimental (per RFC 1035) Record Types

<#18618#><#18612#><#18612#> <#6370#>122.<#6370#> <#18618#>

enable_rdata_overflow

Check for DNS Client RData TXT Overflow

The DNS preprocessor does nothing if none of the 3 vulnerabilities it checks for are enabled. It will not operate on TCP sessions picked up midstream, and it will cease operation on a session if it loses state because of missing data (dropped packets).

2.2.13.2 Examples/Default Configuration from snort.conf

Looks for traffic on DNS server port 53. Check for the DNS Client RData overflow vulnerability. Do not alert on obsolete or experimental RData record types.

verbatim315#