Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
tree: 1561da27b5
Fetching contributors…

Cannot retrieve contributors at this time

30 lines (25 sloc) 0.821 kb
##! sensitive DNS lookup.
@load base/frameworks/notice
@load base/protocols/dns
module DNS;
export {
redef enum Notice::Type += {
SensitiveDNS_Lookup,
};
const hot_dns =
/^lemonde.pezcyclingnews.com/ |
/^lemonde.velonews.com/ |
/^www.beammeupscotty.com/ |
/^first.second.third.yahoo.com/
&redef;
}
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &priority=5
{
local orig = c$id$orig_h;
local resp = c$id$resp_h;
if ( hot_dns in query )
NOTICE([$note=SensitiveDNS_Lookup,
$msg=fmt("name lookup of %s", query),
$conn=c,
$sub="name lookup"]);
}
Jump to Line
Something went wrong with that request. Please try again.