<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
Hi Carlos,
<br>
</div>
<div>
<br>
</div>
<div>
could you please share your suricata.yaml and additional a sample pcap of your dns over tls traffic via port 853 if it is possible? If you would not like to share it publicly, but with with, I've attached my PGP key.
</div>
<div>
<br>
</div>
<div>
Thanks,
<br>
</div>
<div>
<br>
</div>
<div>
Konstantin
<br>
</div>
<blockquote type="cite">
On January 5, 2020 at 1:08 PM Carlos Lopez <clopmz@outlook.com> wrote:
<br>
<br>
<div class="ox-335a999652-WordSection1">
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;">Hi all,</span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;"> </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;">I have a DNS cache server based in unbound redirecting all external queries to CloudFlare’s DNS servers via DNS over TLS and as I indicated in the subject, a lot of alerts are triggered as “SURICATA TLS on unusual port”.</span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;"> </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;">I have tried to inform to our Suricata sensors via “app-layer,tls,dp” port 853 is a valid TLS port without luck … I have checked any TLS variable for Suricata without result.</span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;"> </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt; color: black;">Then how to inform Suricata port 853 as a valid port TLS?</span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt;"> </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt;"> </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt;">-- </span></p>
<div>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt;">Regards, </span></p>
<p class="ox-335a999652-MsoNormal"><span style="font-size: 11.0pt;">C. L. Martinez</span></p>
</div>
</div>_______________________________________________
<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org
<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
<br>
<br>Conference: https://suricon.net
<br>Trainings: https://suricata-ids.org/training/
</blockquote>
<div class="default-style">
<br>
</div>
</body>
</html>