Forum Discussion
dragonflymr
Jun 06, 2017Cirrostratus
Hi,
Not sure if I understand correctly - do you need to resolve IP to FQDN instead of FQDN to IP?
If so you need to check DNS query type like [DNS::question type] equals "PTR" and then execute necessary code - I guess you will need check then DNS_RESPONSE event to check if response from DNS server contains domain ending with given domain.
Something like that:
when DNS_RESPONSE {
if { [DNS::question type] eq "PTR" } {
set rrs [DNS::answer]
foreach rr $rrs {
if { [DNS::rdata $rr] ends_with "your.domain" } {
log local0. "----[DNS::rdata $rr] Dropped-----"
drop seems not be working for response
drop
DNS::answer clear
DNS::answer insert "@ 5 [DNS::question class] TXT Blocked"
return
}
}
}
}
Piotr