What is Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack"

[Jitaphon]

Hi All 

I need to know about Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack". I found the firewall drop traffic and hit the threat id-40033, but we try to packet capture with this traffic for DNS query for same source and same destination is not reach 500 times per 60 seconds.  Why Palo drop the query packet? and what's traffic that hit list the threat id-40033?

Threat Prevention 

[Raido_Rattameister]

DNS ANY request means if client asks DNS server "give me all the data".

Now assume you host DNS server and receive DNS ANY request with forged source IP.

Incoming packet to you is small but outgoing packet you send out is big.

This can be used in DDoS attack if attacker sends DNS ANY requests with spoofed source IP of the victim.

DNS servers reply to victim and effectively attacker has achieved amplification attack.

You can test how DNS ANY request looks like from your computer command line:

nslookup -type=any www.ee

[Jitaphon]

@Raido_Rattameister 

Thanks, I want to known, what traffic can be the cause of hit the Threat-ID?

[Raido_Rattameister]

DNS ANY request generates threat id 34842 (DNS ANY Request).

Multiple DNS ANY requests in a row generate 40033 (DNS ANY Queries Brute Force DOS Attack).

[Jitaphon]

@Raido_Rattameister 

How can I check for this matter?
"Now assume you host DNS server and receive DNS ANY request with forged source IP."

"Incoming packet to you is small but outgoing packet you send out is big."

[Raido_Rattameister]

DNS ANY is logged under threat id 34842 so you can check firewall threat log using filter below..

( threatid eq 34842 )

[ymiyashita]

According to the KB,
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmpCAC

40033 is triggered if a session has same source and same destination but triggers our child signature, 34842, 250 times in 30 seconds. (not 500 times per 60 seconds).

[Raido_Rattameister]

Every time computer tries to resolve DNS request it will send out request to every DNS suffix it has.

In addition depending on operating system it might send those requests to all its DNS servers simultaneously .

Add count column and you see that single line can actually be multiple events.

Below is small demo I ran through firewall.