Please answer to my requests and provide something that can be used to reproduce your issue.
What i have to send? Please tell me
Signature, dataset file and a pcap file containing the traffic you try to block.
Okay, Give me 2 minutes
zoom.pcapng (195.1 KB)
drop ip any any → any any (msg:“APP-Detect”; dns_query; dataset:isset,dns-bl; sid:203720; rev:1;)
created a dataset named dns-bl.lst
The pcap file contains no hit to zoom.us hostname:
cat /tmp/eve.json |grep zoom|grep dns| jq .dns.rrname
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
"us04web.zoom.us"
dataset is a full string match so your signature can not work.
Also your encoding of the zoom.us string seems off (I bet you did not follow my indication on generating it)
open that pcap file in wireshark and apply a search filter “frame contains zoom”
comment edited and please reread.
By the way, don’t use wireshark. Run the pcap in suricata and check dns transaction log to see what has been done. We don’t want wireshark truth but Suricata one when writing a signture.
Okay Sir.
Please guide me step by step.
I will follow all your instruction but kindly please guide me the instructions clearly.
Instruction are clear. Please just read everything I’ve written. I’m stopping there the interaction.
If possible can you please guide me step by step.
Such as i created a dataset file named dns-bl.lst in which i put base64 encrypted text of zoom.
then i created a custom signature rule drop ip any any → any any (msg:“APP-Detect”; dns_query; dataset:isset,dns-bl; sid:203720; rev:1;)
and enable dataset keyword in suricata.yaml file
datasets:
dns-bl:
type: string
state: dns-bl.lst
Is any step wrong in the above???
@Prateek-Sharma please take some time to read the docs, read the thread above and try things. Posting every couple of minutes is not productive and borders on being rude.
Got the right way to use datasets.
No that is not correct. Datasets are also supported in Suricata 6 for example, see 7.34. Datasets — Suricata 6.0.13 documentation