[Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port

[Carlos Lopez]

Hi Konstatin,

Pcap attached. I am using default config from Suricata install from source … The only option I have changed is dp …

Many thanks for your help.

--
Regards,
C. L. Martinez

From: Konstantin Klinger <konstantinklinger at mailbox.org>
Date: Sunday, 5 January 2020 at 13:35
To: Carlos Lopez <clopmz at outlook.com>, "oisf-users at lists.openinfosecfoundation.org" <oisf-users at lists.openinfosecfoundation.org>
Subject: Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port

Hi Carlos,

could you please share your suricata.yaml and additional a sample pcap of your dns over tls traffic via port 853 if it is possible? If you would not like to share it publicly, but with with, I've attached my PGP key.

Thanks,

Konstantin
On January 5, 2020 at 1:08 PM Carlos Lopez <clopmz at outlook.com> wrote:

Hi all,



I have a DNS cache server based in unbound redirecting all external queries to CloudFlare’s DNS servers via DNS over TLS and as I indicated in the subject, a lot of alerts are triggered as  “SURICATA TLS on unusual port”.



I have tried to inform to our Suricata sensors via “app-layer,tls,dp” port 853 is a valid TLS port without luck … I have checked any TLS variable for Suricata without result.



Then how to inform Suricata port 853 as a valid port TLS?





--

Regards,

C. L. Martinez
_______________________________________________
Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users

Conference: https://suricon.net
Trainings: https://suricata-ids.org/training/


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20200105/f5363443/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dot_alert.pcap
Type: application/octet-stream
Size: 4995 bytes
Desc: dot_alert.pcap
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20200105/f5363443/attachment-0001.obj>