Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)

DNS cache poisoning, 4004

Can we get some details on what this signatures is looking at? Does it do anything more intelligent than look at query throughput? I'm thinking something more along the lines of these Snort rules:

#by many very smart people

# This may be a high load sig. Take time and seriously consider

# that your dns_servers var is set as narrowly as possible

alert udp any 53 -> $DNS_SERVERS any (msg:"ET CURRENT_EVENTS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008446; rev:8;)

#this will catch large numbers of nxdomain replies, a sign that someone may be trying to poison you

alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive NXDOMAIN responses - Possible DNS Poisoning Attempt Backscatter"; byte_test:1,&,128,2; byte_test:1,&,3,1,relative; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008470; rev:1;)

Cisco Employee

Re: DNS cache poisoning, 4004

4004 just looks for a flood basically. In s347, we're making that pps rate visible. That number is currently set at 500.

I will say that dns responses with more than 1 RR are completely normal and happen all the time. I was watching some of my own dns traffic and I was getting responses with multipl RRs from things like Yahoo, Google CNN... completely normal and legitimate, nothing odd about it.

Does honing in on that make a sig any more specific - not really - its still a flood. Its the rate thats the kicker and what works for small shops, doesn't work for large shops - so you do have to have some handle of what you "normally" see. I'm not saying that looking for more might not be something that's useful, but it'll largely depend on what you normally see.

The traffic itself is legitimate, albeit crammed with bogus data.


Re: DNS cache poisoning, 4004

Thanks for the response.

None of the sigs are perfect, but it seems to me that the RR flood would likely be a better indicator of this than a query flood.


Re: DNS cache poisoning, 4004

At many of our busier/larger customers, this signature was a bit noisy (enough that we had to turn it off). The snort rules seem a bit smarter about detecting an attack than simply triggering on a rate.


Re: DNS cache poisoning, 4004

same here.

CreatePlease to create content