[
https://bro-tracker.atlassian.net/browse/BIT-1460?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22017#comment-22017
]
Johanna Amann commented on BIT-1460:
------------------------------------
Merging this change actually triggers a few changes in our external test suite.
Vlad, could you potentially take a short look if those seem to make sense?
> DPD query too large on multicast DNS
> ------------------------------------
>
> Key: BIT-1460
> URL: https://bro-tracker.atlassian.net/browse/BIT-1460
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: BinPAC
> Affects Versions: 2.4
> Reporter: Michal Purzynski
> Assignee: Johanna Amann
> Labels: analyzer
> Attachments: dnsm.pcap
>
>
> Lots of
> 1440024833.696698 CZdljELZjJSLLQpxj 10.251.27.165 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440024920.764444 CgVrZf4IQ0Tc04EfQe 10.251.29.250 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440024920.764923 C4oQOB2GRRhDHW1i4g fe80::6676:baff:feb5:772c
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> 1440024981.016577 CsCwiq3qk2Uxjhomjj fe80::1c8a:768d:e113:e39f
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> 1440024981.015551 CA1nbO23vgbca2PBYi 10.251.28.176 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440025022.962007 C5kYaG3BckRrVOot89 10.251.26.99 5353
> 224.0.0.251 5353 udp DNS DNS_Conn_count_too_large
> 1440025022.962049 CrkZft38lJ0YqGqxsl fe80::2acf:e9ff:fe1a:9aed
> 5353 ff02::fb 5353 udp DNS DNS_Conn_count_too_large
> for just UDP and port 5353 - multicast DNS
> Pcaps attached.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-04-018#70102)
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
