ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt
Sourceet/open
CreatedJuly 30, 2010
UpdatedJuly 26, 2019
Classificationbad-unknown
alert udp any 53 -> $DNS_SERVERS any (msg:"ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold:type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008446; rev:9; metadata:created_at 2010_07_30, confidence Medium, signature_severity Minor, updated_at 2019_07_26;)
Metadata
created at2010_07_30
confidenceMedium
signature severityMinor
updated at2019_07_26
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!