diff options
| author | Luca Deri <deri@ntop.org> | 2020-08-21 18:41:35 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2020-08-21 18:41:35 +0200 |
| commit | b23781e80735bf856bf5d7f364a382dd85b8cd28 (patch) | |
| tree | 218cf5e59adab62e83f052d69a024a6a52589709 /tests/pcap | |
| parent | da2684dbe17dd45d3c0b9534d1e2a01cce1168b7 (diff) | |
Added the ability do identigy as DGA those host/domain names with too many consucutive repeated characters
such as ckaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa used fr netbios reflection attacks
https://www.akamai.com/uk/en/multimedia/documents/state-of-the-internet/ddos-reflection-netbios-name-server-rpc-portmap-sentinel-udp-threat-advisory.pdf
Diffstat (limited to 'tests/pcap')
| -rw-r--r-- | tests/pcap/netbios_wildcard_dns_query.pcap | bin | 0 -> 132 bytes |
1 files changed, 0 insertions, 0 deletions
diff --git a/tests/pcap/netbios_wildcard_dns_query.pcap b/tests/pcap/netbios_wildcard_dns_query.pcap Binary files differnew file mode 100644 index 000000000..aafb71f45 --- /dev/null +++ b/tests/pcap/netbios_wildcard_dns_query.pcap |