[Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port

Sun Jan 5 13:19:21 UTC 2020

Works for me as expected with Suricata 5.0. Suricata can parse TLS on that port as expected and parses it also. Eve json output and alert generation are working.

suricata.yaml:

tls:
enabled: yes
detection-ports:
dp: 443, 853

fast.log:

01/05/2020-13:47:29.304261 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.304418 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.304421 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.304422 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.311176 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.331169 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.331457 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.331842 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.351653 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.419592 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.419935 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.420171 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.439981 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.440178 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358

Rule:
alert tls any any -> any any (msg:"FOO TLS"; sid:1; rev:1;)

Example eve json output entry:

{
"timestamp": "2020-01-05T13:47:29.304422+0100",
"flow_id": 84670362485565,
"pcap_cnt": 8,
"event_type": "tls",
"src_ip": "172.22.54.6",
"src_port": 16358,
"dest_ip": "1.1.1.1",
"dest_port": 853,
"proto": "TCP",
"tls": {
"subject": "C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflare-dns.com",
"issuerdn": "C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA",
"serial": "01:CC:E3:18:DE:9F:56:7F:AB:2B:24:90:1F:AD:A7:1D",
"fingerprint": "66:56:84:01:72:b4:fb:bc:d6:d0:a4:a1:03:49:1e:93:00:4d:19:5f",
"version": "TLS 1.2",
"notbefore": "2019-01-28T00:00:00",
"notafter": "2021-02-01T12:00:00",
"ja3": {},
"ja3s": {}
}
}

> On January 5, 2020 at 1:50 PM Carlos Lopez <clopmz at outlook.com> wrote:
> 
> 
>     Hi Konstatin,
> 
> 
>     Pcap attached. I am using default config from Suricata install from source … The only option I have changed is dp …
> 
> 
>     Many thanks for your help.
> 
> 
>     -- 
> 
>     Regards,
> 
>     C. L. Martinez
> 
> 
>     From: Konstantin Klinger <konstantinklinger at mailbox.org>
>     Date: Sunday, 5 January 2020 at 13:35
>     To: Carlos Lopez <clopmz at outlook.com>, "oisf-users at lists.openinfosecfoundation.org" <oisf-users at lists.openinfosecfoundation.org>
>     Subject: Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port
> 
> 
>     Hi Carlos,
> 
> 
>     could you please share your suricata.yaml and additional a sample pcap of your dns over tls traffic via port 853 if it is possible? If you would not like to share it publicly, but with with, I've attached my PGP key.
> 
> 
>     Thanks,
> 
> 
>     Konstantin
> 
>         > > 
> >         On January 5, 2020 at 1:08 PM Carlos Lopez <clopmz at outlook.com> wrote:
> > 
> >         Hi all,
> > 
> >          
> > 
> >         I have a DNS cache server based in unbound redirecting all external queries to CloudFlare’s DNS servers via DNS over TLS and as I indicated in the subject, a lot of alerts are triggered as  “SURICATA TLS on unusual port”.
> > 
> >          
> > 
> >         I have tried to inform to our Suricata sensors via “app-layer,tls,dp” port 853 is a valid TLS port without luck … I have checked any TLS variable for Suricata without result.
> > 
> >          
> > 
> >         Then how to inform Suricata port 853 as a valid port TLS?
> > 
> > 
> > 
> >         -- 
> > 
> >         Regards,
> > 
> >         C. L. Martinez
> > 
> >         _______________________________________________
> >         Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> >         Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> >         List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> > 
> >         Conference: https://suricon.net
> >         Trainings: https://suricata-ids.org/training/
> > 
> >     > 
> 
>      
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20200105/b3e7b803/attachment.html>