Non-RFC Compliant DNS Traffic on Port 53/5353

Arunkumar27 — Wed, 30 Aug 2023 10:17:54 GMT

HI,

Continuously receiving vulnerability threat events (Non-RFC Compliant DNS Traffic on Port 53/5353(56538)) form the same source IP towards our PA public IP addresses. The source is also clean and belongs to Vodafone ISP.

I could not find any other trace to resolve the issue.

Please assist how I can proceed to resolve it. What action I should take to find the root cause?

Sample Log:

Thanks

Re: Non-RFC Compliant DNS Traffic on Port 53/5353

reaper — Wed, 30 Aug 2023 11:43:21 GMT

you can enable packetcapture in the threat log so you can capture one of these DNS queries to see what they look like

that pcap can then be used to report a false positive with Palo TAC or get back to vodafone and let them know about potentially malformed dns queries

hope this helps

Re: Non-RFC Compliant DNS Traffic on Port 53/5353

reaper — Wed, 30 Aug 2023 11:43:27 GMT

you can enable packetcapture in the threat log so you can capture one of these DNS queries to see what they look like

that pcap can then be used to report a false positive with Palo TAC or get back to vodafone and let them know about potentially malformed dns queries

hope this helps

topic Re: Non-RFC Compliant DNS Traffic on Port 53/5353 in General Topics

Non-RFC Compliant DNS Traffic on Port 53/5353

Re: Non-RFC Compliant DNS Traffic on Port 53/5353

Re: Non-RFC Compliant DNS Traffic on Port 53/5353