[
https://bro-tracker.atlassian.net/browse/BIT-1460?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=21970#comment-21970
]
Johanna Amann commented on BIT-1460:
------------------------------------
I think I concur. I will merge this into master with the limit at 25 and into
2.4.1 with the limit at 5 (so the only difference is that people in 2.4.1 will
be able to redef it if they want to - but there will be no surprising change of
how things work).
> DPD query too large on multicast DNS
> ------------------------------------
>
> Key: BIT-1460
> URL: https://bro-tracker.atlassian.net/browse/BIT-1460
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: BinPAC
> Affects Versions: 2.4
> Reporter: Michal Purzynski
> Assignee: Johanna Amann
> Labels: analyzer
> Attachments: dnsm.pcap
>
>
> Lots of
> 1440024833.696698 CZdljELZjJSLLQpxj 10.251.27.165 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440024920.764444 CgVrZf4IQ0Tc04EfQe 10.251.29.250 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440024920.764923 C4oQOB2GRRhDHW1i4g fe80::6676:baff:feb5:772c
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> 1440024981.016577 CsCwiq3qk2Uxjhomjj fe80::1c8a:768d:e113:e39f
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> 1440024981.015551 CA1nbO23vgbca2PBYi 10.251.28.176 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440025022.962007 C5kYaG3BckRrVOot89 10.251.26.99 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440025022.962049 CrkZft38lJ0YqGqxsl fe80::2acf:e9ff:fe1a:9aed
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> for just UDP and port 5353 - multicast DNS
> Pcaps attached.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-02-259#70102)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
