Search:

Type: Posts; User: Opus00; Keyword(s):

Search: Search took 0.01 seconds.

  1. June 29th, 2005, 08:57 PM

    Thread: DNS Zone Transfer

    by Opus00
    Replies
    5
    Views
    6,464

    If i'm not mistaken, the request for a zone...

    If i'm not mistaken, the request for a zone transfer is made over udp port 53, the actual data transfer is tcp port 53.

    In the sig I posted above, notice is says "alert udp". Since the request...
  2. June 29th, 2005, 08:13 PM

    Thread: DNS Zone Transfer

    by Opus00
    Replies
    5
    Views
    6,464

    Snort has an active sig to detect zone transfers...

    Snort has an active sig to detect zone transfers out of the box.

    alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer UDP"; content:"|00 00 FC|"; offset:14; reference:arachnids,212;...
Results 1 to 2 of 2