Monitor NXDOMAIN Unknown Answers (Failures)

[bengbrewer]

Does anyone know if it is possible to monitor for NXDOMAIN Unknown Answers (Failures) with PanOS 5.0 ?

Would it be a custom signature/application that needs to be created?

[panos]

I did not hear about any function doing that.

if Nxdomain answers has a common criteria maybe....

[mikand]

According to the manual "DNS" is currently not available (in PANOS 5.0) as decoder for custom signatures.

If it were you would be able to create a custom signature that brings you an alert (a log entry) each time a NXDOMAIN answer is seen.

Without the decoder you can still create a custom signature based on the hex-values but then this string must be 7 chars (or something like that) and you will most likely get a bunch of false positives because this string is matched through the whole session and not just in a specific "field".

[jwolach]

Hello Bengbrewer,

You can create a Custom Vulnerability Signature to look for the HEX values in a DNS Response header part of a packet that has the No Such Name flag (NXDOMAIN).  Below is my custom signature to do just that.

<vulnerability-threat version="6.0.0">

  <entry name="41000">

    <signature>

      <standard>

        <entry name="NXDOMAIN">

          <and-condition>

            <entry name="And Condition 1">

              <or-condition>

                <entry name="Or Condition 1">

                  <operator>

                    <pattern-match>

                      <pattern>\x81830001000000\x</pattern>

                      <context>dns-rsp-header</context>

                    </pattern-match>

                  </operator>

                </entry>

              </or-condition>

            </entry>

          </and-condition>

          <order-free>no</order-free>

          <scope>protocol-data-unit</scope>

        </entry>

      </standard>

    </signature>

    <default-action>

      <alert/>

    </default-action>

    <threatname>NXDOMAIN</threatname>

    <severity>informational</severity>

    <direction>server2client</direction>

    <affected-host>

      <client>yes</client>

      <server>yes</server>

    </affected-host>

  </entry>

</vulnerability-threat>

Hope it helps.

Kind regards,

Jeff