Hi
I’m investigating dns.log file with below command:
cat dns.log | bro-cut id.orig_h query | sort -r | uniq -c
and in output i see this line:
1 10.10.27.15 *\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
but i do not know what is this and what is meaning.
please let me know what is meaning and does it mean a threat or not?
Regards,
Mahdi
That is netbios lookups. What is the port?
Shane
Mahdi,
I have seen this data as well in the DNS log. From what we’ve been able to determine it is not DNS traffic but name resolution over NetBIOS.
we see that commonly with port 5353, multicast DNS. It has also resulted in a lot of noise, so we ended up removing 5353 from the config.
zeek mailing list -- zeek@lists.zeek.org
To unsubscribe send an email to zeek-leave@lists.zeek.org