Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IP v6 arpa request are showing up in the "exploded dns" report #709

Open
nighttardis opened this issue Oct 4, 2021 · 0 comments · May be fixed by #710
Open

IP v6 arpa request are showing up in the "exploded dns" report #709

nighttardis opened this issue Oct 4, 2021 · 0 comments · May be fixed by #710
Labels
bug needs review

Comments

@nighttardis
Copy link

While testing RITA, I started noticing that ip6.arpa requests were showing up in the "exploded dns" report, where 'in-addr.arpa' requests were not. This appears to just be an oversight while coding the filters.

How to reproduce: Run RITA against Zeek DNS logs containing IP v6 arpa lookups.

RITA version: 4.4.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug needs review
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Filter out IPv6 reverse DNS lookups from DNS analysis nighttardis/rita
3 participants
@Zalgo2462 @nighttardis @mrkeithchew