RES: DNS 53 <-> 53 ?

["Marcus Rocha" <mvrocha () brfree com br>]

Hi!

> This looks like a DNS Server is using a forwarder.  When a DNS
> Server cannot
> resolve a name from its own zone files or cache, and has a forwarder
> configured, it passes the query to the forward lookup server.
> Communication
> is 53<->53, as you discovered.  This is quite normal behaviour (if both
> servers are DNS servers).  If there are no forwarders configured it will
> start probing root servers (a.root-servers.net, b.root-servers.net etc),
> with similar port information.

Thus, would it be possible to do something with MISC.RULES to ignore inbound
answers with 53<>53 ???

> ...

Regards,
Marcus


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users