<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
Works for me as expected with Suricata 5.0. Suricata can parse TLS on that port as expected and parses it also. Eve json output and alert generation are working.
<br>
</div>
<div>
<br>
</div>
<div>
suricata.yaml:
</div>
<div>
<br>
</div>
<div>
tls:
<br>enabled: yes
<br>detection-ports:
<br>dp: 443, 853
<br>
</div>
<div>
<br>
</div>
<div>
fast.log:
</div>
<div>
<br>
</div>
<div>
01/05/2020-13:47:29.304261 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.304418 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.304421 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.304422 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.311176 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.331169 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.331457 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.331842 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.351653 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.419592 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.419935 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.420171 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.439981 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.440178 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
</div>
<div>
<br>
</div>
<div>
Rule:
<br>
</div>
<div>
alert tls any any -> any any (msg:"FOO TLS"; sid:1; rev:1;)
<br>
</div>
<div>
<br>
</div>
<div>
Example eve json output entry:
<br>
</div>
<div>
<br>
</div>
<div>
{
<br>"timestamp": "2020-01-05T13:47:29.304422+0100",
<br>"flow_id": 84670362485565,
<br>"pcap_cnt": 8,
<br>"event_type": "tls",
<br>"src_ip": "172.22.54.6",
<br>"src_port": 16358,
<br>"dest_ip": "1.1.1.1",
<br>"dest_port": 853,
<br>"proto": "TCP",
<br>"tls": {
<br>"subject": "C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflare-dns.com",
<br>"issuerdn": "C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA",
<br>"serial": "01:CC:E3:18:DE:9F:56:7F:AB:2B:24:90:1F:AD:A7:1D",
<br>"fingerprint": "66:56:84:01:72:b4:fb:bc:d6:d0:a4:a1:03:49:1e:93:00:4d:19:5f",
<br>"version": "TLS 1.2",
<br>"notbefore": "2019-01-28T00:00:00",
<br>"notafter": "2021-02-01T12:00:00",
<br>"ja3": {},
<br>"ja3s": {}
<br>}
<br>}
<br>
</div>
<blockquote type="cite">
On January 5, 2020 at 1:50 PM Carlos Lopez <clopmz@outlook.com> wrote:
<br>
<br>
<div class="ox-5b4ed10b72-WordSection1">
<p class="ox-5b4ed10b72-MsoNormal">Hi Konstatin,</p>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
<p class="ox-5b4ed10b72-MsoNormal">Pcap attached. I am using default config from Suricata install from source … The only option I have changed is dp …</p>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
<p class="ox-5b4ed10b72-MsoNormal">Many thanks for your help.</p>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
<div>
<p class="ox-5b4ed10b72-MsoNormal">-- </p>
<div>
<p class="ox-5b4ed10b72-MsoNormal">Regards,</p>
</div>
</div>
<p class="ox-5b4ed10b72-MsoNormal">C. L. Martinez</p>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
<div style="border: none; border-top: solid #B5C4DF 1.0pt; padding: 3.0pt 0cm 0cm 0cm;">
<p class="ox-5b4ed10b72-MsoNormal"><strong><span style="font-size: 12.0pt; color: black;">From: </span></strong><span style="font-size: 12.0pt; color: black;">Konstantin Klinger <konstantinklinger@mailbox.org><br><strong>Date: </strong>Sunday, 5 January 2020 at 13:35<br><strong>To: </strong>Carlos Lopez <clopmz@outlook.com>, "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org><br><strong>Subject: </strong>Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port </span></p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal">Hi Carlos,</p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal">could you please share your suricata.yaml and additional a sample pcap of your dns over tls traffic via port 853 if it is possible? If you would not like to share it publicly, but with with, I've attached my PGP key.</p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal">Thanks,</p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal"><br></p>
</div>
<div>
<p class="ox-5b4ed10b72-MsoNormal">Konstantin</p>
</div>
<blockquote>
<p style="margin-bottom: 12.0pt;" class="ox-5b4ed10b72-MsoNormal">On January 5, 2020 at 1:08 PM Carlos Lopez <clopmz@outlook.com> wrote:</p>
<div>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;">Hi all,</span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;"> </span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;">I have a DNS cache server based in unbound redirecting all external queries to CloudFlare’s DNS servers via DNS over TLS and as I indicated in the subject, a lot of alerts are triggered as “SURICATA TLS on unusual port”.</span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;"> </span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;">I have tried to inform to our Suricata sensors via “app-layer,tls,dp” port 853 is a valid TLS port without luck … I have checked any TLS variable for Suricata without result.</span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;"> </span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color: black;">Then how to inform Suricata port 853 as a valid port TLS?</span></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><br></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><br></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">-- </p>
<div>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">Regards,</p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">C. L. Martinez</p>
</div>
</div>
<p class="ox-5b4ed10b72-MsoNormal">_______________________________________________ <br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org <br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/ <br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users <br><br>Conference: https://suricon.net <br>Trainings: https://suricata-ids.org/training/</p>
</blockquote>
<div>
<p class="ox-5b4ed10b72-MsoNormal"><br> </p>
</div>
</div>
</blockquote>
<div class="default-style">
<br>
</div>
</body>
</html>