diff options
| author | Luca Deri <deri@ntop.org> | 2022-06-14 00:13:05 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2022-06-14 00:13:05 +0200 |
| commit | defe7d7f79276b60d92addd47f904f417c6a8ea9 (patch) | |
| tree | f16f536d262088a42230ef7a900b899240b9b32f /src/lib/protocols/dns.c | |
| parent | 831562c141a01f73676ac67df9df1e2ea1658e0d (diff) | |
Updated DNS alert triggered only with TTL == 0
Diffstat (limited to 'src/lib/protocols/dns.c')
| -rw-r--r-- | src/lib/protocols/dns.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 784dd2f52..a0942badc 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -310,12 +310,8 @@ static int search_valid_dns(struct ndpi_detection_module_struct *ndpi_struct, rsp_type = get16(&x, packet->payload); rsp_ttl = ntohl(*((u_int32_t*)&packet->payload[x+2])); - if(rsp_ttl < 300) { - char buf[64]; - - snprintf(buf, sizeof(buf), "Low DNS Record TTL %d", rsp_ttl); - ndpi_set_risk(ndpi_struct, flow, NDPI_DNS_SUSPICIOUS_TRAFFIC, buf); - } + if(rsp_ttl == 0) + ndpi_set_risk(ndpi_struct, flow, NDPI_DNS_SUSPICIOUS_TRAFFIC, "DNS Record with zero TTL"); #ifdef DNS_DEBUG printf("[DNS] TTL = %u\n", rsp_ttl); |