DNS queries - custom signatures

[migration]

Hi all,

does anyone know how can I identify (if possible) DNS queries from client toward particular web sites. The aim is to see and eventually block some DNS queries that try to resolve forbidden sites. I can't use URL filtering license.

Thanks

[migration]

Any answers, please?

Thanks

[mhuels]

Perhaps the easiest way should be to put something like

www.unwished.com   www.yourcompany.com

in the /etc/hosts of your DNS-Server.

Another way could be to configure a redirection in your squid proxy - if existing.

The "unknown-req-udp-payload" pattern matching in a PA spyware custom signature is not to very promising. The "Data Filtering" pattern matching looks only to files, and only to a few types of them.

[rapoint_person]

If you only have a "limited" number of forbidden sites, why not create apps of these sites and then use the custom apps to allow/deny access?

[migration]

Hi guys,

thanks for your answer.

I need to monitor or block dns queries toward particular web sites, not the http requests. 🙂

I see the "udp-request-payload" context but...I would like to know how-to use it and if it can meet my needs...

Any help would be appreciated.

Thanks

[migration]

Hi,

does anyone of PAN support know how and when I can use "unknown-req-udp-payload" context?

Is it useful for all udp communication not better recognized or something else?

If I want to identify and block DNS queries toward ie. google.com, can I create a custom signature with "unknown-req-udp-payload" and use google.com as pattern or it won't be identified because it is already a "dns" signature and won't fall in my custom signature?

Thanks

[gsamuels]

Context  'unknown-req-udp-payload'  will allow you to match the udp payload, and as in all other cases the custom signature will take prescience.

[migration]

Hi Samuels,

could you give me an example of  'unknown-req-udp-payload'  that identify an A query to resolve example.com ?

I tried many patterns but without success...

Thanks