topic Re: Monitor NXDOMAIN Unknown Answers (Failures) in General Topics

Monitor NXDOMAIN Unknown Answers (Failures)

bengbrewer — Mon, 06 May 2013 01:32:49 GMT

Does anyone know if it is possible to monitor for NXDOMAIN Unknown Answers (Failures) with PanOS 5.0 ?

Would it be a custom signature/application that needs to be created?

Re: Monitor NXDOMAIN Unknown Answers (Failures)

Retired Member — Sun, 09 Jun 2013 02:36:47 GMT

I did not hear about any function doing that.

if Nxdomain answers has a common criteria maybe....

Re: Monitor NXDOMAIN Unknown Answers (Failures)

mikand — Mon, 10 Jun 2013 06:54:21 GMT

According to the manual "DNS" is currently not available (in PANOS 5.0) as decoder for custom signatures.

If it were you would be able to create a custom signature that brings you an alert (a log entry) each time a NXDOMAIN answer is seen.

Without the decoder you can still create a custom signature based on the hex-values but then this string must be 7 chars (or something like that) and you will most likely get a bunch of false positives because this string is matched through the whole session and not just in a specific "field".

Re: Monitor NXDOMAIN Unknown Answers (Failures)

jwolach — Wed, 18 Jun 2014 23:16:58 GMT

Hello Bengbrewer,

You can create a Custom Vulnerability Signature to look for the HEX values in a DNS Response header part of a packet that has the No Such Name flag (NXDOMAIN). Below is my custom signature to do just that.

<vulnerability-threat version="6.0.0">

<and-condition>

<or-condition>

<pattern-match>

<context>dns-rsp-header</context>

</pattern-match>

</operator>

</entry>

</or-condition>

</entry>

</and-condition>

<order-free>no</order-free>

<scope>protocol-data-unit</scope>

</entry>

</standard>

</signature>

<default-action>

</default-action>

<threatname>NXDOMAIN</threatname>

<severity>informational</severity>

<direction>server2client</direction>

<affected-host>

</affected-host>

</entry>

</vulnerability-threat>

Hope it helps.

Kind regards,

Jeff