]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/commit
Suricata: detect DNS events on port 853, too
authorPeter Müller <peter.mueller@ipfire.org>
Thu, 7 Feb 2019 17:47:00 +0000 (17:47 +0000)
committerStefan Schantl <stefan.schantl@ipfire.org>
Thu, 7 Feb 2019 20:26:50 +0000 (21:26 +0100)
commitad99f959e2b83dd9f1275c1d385140271c8926ae
tree8e5014b09b3b04080ba5e76e3652f8ac40eb6ac6
parent8723bb91aeff7dbbc173c6f7b8052a76203cb0a5
Suricata: detect DNS events on port 853, too

As DNS over TLS popularity is increasing, port 853 becomes
more interesting for an attacker as a bypass method. Enabling
this port for DNS monitoring makes sense in order to avoid
unusual activity (non-DNS traffic) as well as "normal" DNS
attacks.

Partially fixes #11808

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
config/suricata/suricata.yaml