webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Suricata: detect DNS events on port 853, too

Browse Source 
As DNS over TLS popularity is increasing, port 853 becomes
more interesting for an attacker as a bypass method. Enabling
this port for DNS monitoring makes sense in order to avoid
unusual activity (non-DNS traffic) as well as "normal" DNS
attacks.

Partially fixes #11808

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This commit is contained in:
Peter Müller
2019-02-07 17:47:00 +00:00
committed by Stefan Schantl
parent 8723bb91ae
commit ad99f959e2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/suricata/suricata.yaml
View File

@@ -208,11 +208,11 @@ app-layer:
tcp:
enabled: yes
detection-ports:
dp: 53
dp: "[53,853]"
udp:
enabled: yes
detection-ports:
dp: 53
dp: "[53,853]"
http:
enabled: yes
# memcap: 64mb