NCSA/external_dns/main.zeek

DNS

Raises a notice when a client is observed querying an external DNS server

Namespace

DNS

Imports

base/frameworks/notice, base/protocols/dns

Summary

Runtime Options

DNS::ignore_external: set &redef

Ignore the following servers

DNS::local_countries: set &redef

Anything not in this list is considered a foreign country

Detailed Interface

Runtime Options

DNS::ignore_external
Type

set [subnet]

Attributes

&redef

Default
{
   8.8.8.8/32,
   208.67.220.123/32,
   208.67.220.220/32,
   208.67.222.222/32,
   8.8.4.4/32
}

Ignore the following servers

DNS::local_countries
Type

set [string]

Attributes

&redef

Default
{
   "US"
}

Anything not in this list is considered a foreign country