03-23-2023 01:08 AM
I need to know about Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack". I found the firewall drop traffic and hit the threat id-40033, but we try to packet capture with this traffic for DNS query for same source and same destination is not reach 500 times per 60 seconds. Why Palo drop the query packet? and what's traffic that hit list the threat id-40033?
03-23-2023 09:37 AM - edited 03-23-2023 09:38 AM
DNS ANY request means if client asks DNS server "give me all the data".
Now assume you host DNS server and receive DNS ANY request with forged source IP.
Incoming packet to you is small but outgoing packet you send out is big.
This can be used in DDoS attack if attacker sends DNS ANY requests with spoofed source IP of the victim.
DNS servers reply to victim and effectively attacker has achieved amplification attack.
You can test how DNS ANY request looks like from your computer command line:
nslookup -type=any www.ee
03-26-2023 07:32 AM
03-26-2023 09:53 AM - edited 03-26-2023 09:57 AM
DNS ANY request generates threat id 34842 (DNS ANY Request).
Multiple DNS ANY requests in a row generate 40033 (DNS ANY Queries Brute Force DOS Attack).
03-26-2023 11:12 PM
How can I check for this matter?
"Now assume you host DNS server and receive DNS ANY request with forged source IP."
"Incoming packet to you is small but outgoing packet you send out is big."
03-27-2023 05:20 AM
DNS ANY is logged under threat id 34842 so you can check firewall threat log using filter below..
( threatid eq 34842 )
03-27-2023 10:24 PM
According to the KB,
40033 is triggered if a session has same source and same destination but triggers our child signature, 34842, 250 times in 30 seconds. (not 500 times per 60 seconds).
03-27-2023 10:44 PM - edited 03-27-2023 10:45 PM
Every time computer tries to resolve DNS request it will send out request to every DNS suffix it has.
In addition depending on operating system it might send those requests to all its DNS servers simultaneously .
Add count column and you see that single line can actually be multiple events.
Below is small demo I ran through firewall.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!