[Snort-users] Funky DNS volley

James Lay jlay at ...13475...
Thu Apr 25 11:42:28 EDT 2013


Now THIS is a weird DNS req/res:

2013-04-25 07:58:38    IP    53555   IP    53      udp     39989   
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa 
       1       C_INTERNET      12      PTR     0       NOERROR T       F 
      T       T       0      localhost        86400.000000

Sig worthy to mod the recent 127.0.0.1 DNS response to reflect 
localhost?

James




More information about the Snort-users mailing list