DNS non-Internet lookup
advICE :Intrusions : 2000404

Summary

A anomolous DNS request was sent to your machine.

Details

First all, note that a DNS request was sent to your machine. This is certainly a strange thing to see if the system is a desktop machine. This may come from a scan for DNS servers, or a misconfiguration of the potential intruder.

This event triggers when a DNS request for a non-Internet name is seen. This is an anomaly. It is not necessarily an attack, but something to note. If you are running a DNS server that handles lots of non-Internet requests, then you should disable this alert detection.

False Positives

As per the discussion above, you will falsely see these alerts if you run a DNS server and intentionally use it for non-Internet class lookups.

parametric information class The class field of the DNS request.

 
Version appeared: