mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
mDNS Keywords
|
|
|
|
|
=============
|
|
|
|
|
|
|
|
|
|
Suricata supports sticky buffers for efficiently matching on specific
|
|
|
|
|
fields in mDNS (Multicast DNS) messages.
|
|
|
|
|
|
|
|
|
|
Note that sticky buffers are expected to be followed by one or more
|
|
|
|
|
:doc:`payload-keywords`.
|
|
|
|
|
|
|
|
|
|
mdns.queries.rrname
|
|
|
|
|
-------------------
|
|
|
|
|
|
|
|
|
|
``mdns.queries.rrname`` is a sticky buffer that is used to look at the
|
|
|
|
|
name field in mDNS query resource records.
|
|
|
|
|
|
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
|
|
|
resource name, for example "host.local".
|
|
|
|
|
|
|
|
|
|
``mdns.queries.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
|
|
|
|
|
alert udp any any -> any 5353 (msg:"mDNS query for .local domain"; \
|
|
|
|
|
mdns.queries.rrname; content:".local"; sid:1;)
|
|
|
|
|
|
|
|
|
|
mdns.answers.rrname
|
|
|
|
|
-------------------
|
|
|
|
|
|
|
|
|
|
``mdns.answers.rrname`` is a sticky buffer that is used to look at the
|
|
|
|
|
name field in mDNS answer resource records.
|
|
|
|
|
|
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
|
|
|
resource name, for example "printer.local".
|
|
|
|
|
|
|
|
|
|
``mdns.answers.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
|
|
|
|
|
alert udp any 5353 -> any any (msg:"mDNS answer for printer.local"; \
|
|
|
|
|
mdns.answers.rrname; content:"printer.local"; sid:2;)
|
|
|
|
|
|
|
|
|
|
mdns.authorities.rrname
|
|
|
|
|
-----------------------
|
|
|
|
|
|
|
|
|
|
``mdns.authorities.rrname`` is a sticky buffer that is used to look at the
|
|
|
|
|
rrname field in mDNS authority resource records.
|
|
|
|
|
|
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
|
|
|
resource name, for example "device.local".
|
|
|
|
|
|
|
|
|
|
``mdns.authorities.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
|
|
|
|
|
alert udp any 5353 -> any any (msg:"mDNS authority record check"; \
|
|
|
|
|
mdns.authorities.rrname; content:"auth.local"; sid:3;)
|
|
|
|
|
|
|
|
|
|
mdns.additionals.rrname
|
|
|
|
|
-----------------------
|
|
|
|
|
|
|
|
|
|
``mdns.additionals.rrname`` is a sticky buffer that is used to look at
|
|
|
|
|
the rrname field in mDNS additional resource records.
|
|
|
|
|
|
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
|
|
|
resource name, for example "service.local".
|
|
|
|
|
|
|
|
|
|
``mdns.additionals.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
|
|
|
|
|
alert udp any any -> any 5353 (msg:"mDNS additional record check"; \
|
|
|
|
|
mdns.additionals.rrname; content:"_companion-link._tcp.local"; nocase; sid:4;)
|
|
|
|
|
|
|
|
|
|
mdns.response.rrname
|
|
|
|
|
--------------------
|
|
|
|
|
|
|
|
|
|
``mdns.response.rrname`` is a sticky buffer that is used to inspect
|
|
|
|
|
all the rrname fields in a response, in the queries, answers,
|
|
|
|
|
additionals and authorities. Additionally it will also inspect rdata
|
|
|
|
|
fields that have the same format as an rrname (hostname).
|
|
|
|
|
|
|
|
|
|
``rdata`` types that will be inspected are:
|
|
|
|
|
|
|
|
|
|
* CNAME
|
|
|
|
|
* PTR
|
|
|
|
|
* MX
|
|
|
|
|
* NS
|
|
|
|
|
* SOA
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
1 year ago
|
|
|
|
|
|
|
|
alert udp any 5353 -> any any (msg:"mDNS answer data match"; \
|
|
|
|
|
mdns.response.rrname; content:"Apple TV"; sid:5;)
|
