This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

weird dns ips ipv6 alerts today

noticed this today, 100+ weird dns ips ipv6 events

Message........: PROTOCOL-DNS IPv6 host name enumeration
Details........: https://www.snort.org/search?query=27938
Time...........: 2018-05-24 14:29:52
Packet dropped.: no
Priority.......: medium
Classification.: Attempted Information Leak
IP protocol....: 17 (UDP)

Source IP address: 192.168.0.4
Source port: 59216
Destination IP address: 8.8.8.8 (google-public-dns-a.google.com)
Destination port: 53 (domain)

I cannot workout cause of this

This thread was automatically locked due to age.

Parents

0 John Blue over 6 years ago

Not knowing what the actual queries are means there is not a lot to go on here ..

But it looks like to me 192.168.0.4 was banging on google for AAAA's and the IPS said whoa. Past that is nothing but speculation.

John
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 John Blue over 6 years ago

Not knowing what the actual queries are means there is not a lot to go on here ..

But it looks like to me 192.168.0.4 was banging on google for AAAA's and the IPS said whoa. Past that is nothing but speculation.

John
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data