topic Re: DNS queries - custom signatures in General Topics

DNS queries - custom signatures

migration — Fri, 20 May 2011 11:37:25 GMT

Hi all,

does anyone know how can I identify (if possible) DNS queries from client toward particular web sites. The aim is to see and eventually block some DNS queries that try to resolve forbidden sites. I can't use URL filtering license.

Thanks

Re: DNS queries - custom signatures

migration — Sun, 29 May 2011 18:33:21 GMT

Any answers, please?

Thanks

Re: DNS queries - custom signatures

mhuels — Mon, 30 May 2011 14:37:31 GMT

Perhaps the easiest way should be to put something like

www.unwished.com www.yourcompany.com

in the /etc/hosts of your DNS-Server.

Another way could be to configure a redirection in your squid proxy - if existing.

The "unknown-req-udp-payload" pattern matching in a PA spyware custom signature is not to very promising. The "Data Filtering" pattern matching looks only to files, and only to a few types of them.

Re: DNS queries - custom signatures

rapoint_person — Tue, 31 May 2011 13:08:51 GMT

If you only have a "limited" number of forbidden sites, why not create apps of these sites and then use the custom apps to allow/deny access?

Re: DNS queries - custom signatures

migration — Fri, 03 Jun 2011 09:59:15 GMT

Hi guys,

thanks for your answer.

I need to monitor or block dns queries toward particular web sites, not the http requests. 🙂

I see the "udp-request-payload" context but...I would like to know how-to use it and if it can meet my needs...

Any help would be appreciated.

Thanks

Re: DNS queries - custom signatures

migration — Mon, 06 Jun 2011 11:48:03 GMT

Hi,

does anyone of PAN support know how and when I can use "unknown-req-udp-payload" context?

Is it useful for all udp communication not better recognized or something else?

If I want to identify and block DNS queries toward ie. google.com, can I create a custom signature with "unknown-req-udp-payload" and use google.com as pattern or it won't be identified because it is already a "dns" signature and won't fall in my custom signature?

Thanks

Re: DNS queries - custom signatures

gsamuels — Tue, 07 Jun 2011 02:01:48 GMT

Context 'unknown-req-udp-payload' will allow you to match the udp payload, and as in all other cases the custom signature will take prescience.

Re: DNS queries - custom signatures

migration — Tue, 07 Jun 2011 06:54:50 GMT

Hi Samuels,

could you give me an example of 'unknown-req-udp-payload' that identify an A query to resolve example.com ?

I tried many patterns but without success...

Thanks