# Detection of class C IP range in DNS response
**URL:** https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383
**Category:** Rules
**Created:** [April 7, 2022, 6:43pm UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383 "2022-04-07T18:43:44Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@samilionsam35](https://forum.suricata.io/u/samilionsam35)
#### Post date: [April 7, 2022, 6:43pm UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/1 "2022-04-07T18:43:44Z")
Hi all,
I’m trying to write a suricata rule to alert on class C IP range (192.168.1.0/24) in DNS responses.
I found this answer tackling the same problem but with a specific IP in the DNS response (loop back IP) [domain name system - How to make rule trigger on DNS rdata/IP address? - Server Fault](https://serverfault.com/questions/854705/how-to-make-rule-trigger-on-dns-rdata-ip-address)
How can I do the same, but detecting any IP in the class C range?
Can I use regex to detect content in the rdata field?
---
### Author:  [@suricatalfon](https://forum.suricata.io/u/suricatalfon)
#### Post date: [April 8, 2022, 5:13am UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/2 "2022-04-08T05:13:46Z")
Hí,
I’ll give you an example CIDS to see if it works for you.
`alert ip [0.0.0.0/8,192.0.0.0/24,192.0.2.0/24,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24] any -> $HOME_NET any (msg:"...............`
---
### Author:  [@samilionsam35](https://forum.suricata.io/u/samilionsam35)
#### Post date: [April 8, 2022, 2:02pm UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/3 "2022-04-08T14:02:07Z")
Unfortunately that doesn’t solve my problem.
I forgot to mention that I need this rule to detect internal DNS leakage.
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [April 8, 2022, 10:52pm UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/4 "2022-04-08T22:52:48Z")
It would be a good feature request to add `dns.response` in addition to the already available keyword `dns.query`. What you could do is post processing to alert on the event\_type dns where you do have the response field.
You could also try to use the more common keywords to match on specific content parts.
---
### Author:  [@samilionsam35](https://forum.suricata.io/u/samilionsam35)
#### Post date: [April 9, 2022, 11:59am UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/5 "2022-04-09T11:59:09Z")
For sure it would nice to have dns.response keyword.
Post processing all dns alerts would however require so much resources.
Could you give examples on
> [@Andreas\_Herz](#):
>
> more common keywords
that I can use?
---
### Author:  [@bmurphy](https://forum.suricata.io/u/bmurphy)
#### Post date: [April 13, 2022, 11:18pm UTC](https://forum.suricata.io/t/detection-of-class-c-ip-range-in-dns-response/2383/6 "2022-04-13T23:18:26Z")
Hey there @samilionsam35!
This is a much more tricky problem than it really should be.
There is a [feature request](https://redmine.openinfosecfoundation.org/issues/2448) that should help out, but until then, this rule will work for you.
```auto
alert dns any any -> any any (msg:"DNS Response with Answer in 192.168.1.0/24"; content:"|00 01 00 01|"; distance:0; content:"|00 04 c0 a8 01|"; distance:4; within:5; fast_pattern; sid:1;)
```