dns_decoder

[#1]

Hy there Ive got a problem on my FortiGate 200A. I think, my local LAN is slower than normal (Long time to open Files, to print and so one). I ve checked my logs on the firewall and i found the followin entrys

 1 	2011-07-14 	10:05:14 	alert 	192.168.5.1 	195.50.140.41 	dns_decoder: DNS.Name.Overflow

192.168.5.1 --> this is my local DNS Server 195.50.140.41 --> this is an unknown IP Adress This entry repeated at least everey two minutes. Allways the same message, but with different (all me unknown) destination Adresses. On Fortinet KnowledgeBase; they said, that the severitly is low. But i find, that coud be the problem for my slow LAN. Have anybody an idea, to solve this problem? Is there a wron entry in my DNS Zonefile? Thank you alot and regards.

[Matthijs]

Hi, This is an IPS log entry. See your DNS server log files to see what the ip address is looking for. What software version do you run? The ip address is from Vodafone Germany: inetnum: 195.50.128.0 - 195.50.191.255 org: ORG-MAT1-RIPE netname: DE-ARCOR-970730 descr: Vodafone D2 GmbH country: DE admin-c: ANOC1-RIPE tech-c: ANOC1-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: ARCOR-MNT mnt-routes: ARCOR-MNT source: RIPE # Filtered

[#3]

Thank you. I run Suse Linux 10.1.... Its almost another IP, which is on this error Log, the IPs change in every message. Thanks and regards

[#4]

Ok, what do you think, is it important to solve this problem? I mean, its only an oversized domain name: .

It indicates detection of a Domain Name Service (DNS) message with an oversized full domain name

I think its a very big effort to check all this IPs, and find out why the DNS Request has an oversized FDN, or what do you think? Thank you.

[Jan_Scholten]

Can you capture the log /(customize IPS,enable packet log)

[Matthijs]

I assume you have a public domain server and you have configured and Intrusion prevention rule on the inbound connection and this is blocking the connections from the outside. The reason that the requests are blocked is because there are some servers with vulnerability' s with large domain names. You can ignore the message if you have no very large domain names configured in your DNS server. If you really want to know what is happening you could try to sniff this traffic but i wonder if you would see the traffic if its blocked by the IPS rule. Sniffing the traffic would be something like this: login to the CLI run the command: diagnose sniffer packet wan1 " port 53" 4 You will then see all DNS requests what may be a large amount of traffic so you might want to specify some external ip (the 195.x.x.x address) also like " port 53 and host 195.50.140.41" if the external ip is often the same.

[ede_pfau]

Laurenzo, you posted because your LAN is slow, and there are log entries. a) with only one entry every 2 minutes the logging itself will have no adverse effect b) as the FGT will block (?) the intrusion, your server will not see it and again no effect on the server. The FGT has no (performance) problem with blocking intrusions at this rate. Just be sure that your IPS rule specifies " action: block" and not only " action: log" . You can safely block these requests as they are non-standard and most probably malicious.

[#8]

Hy, thank you for your answers. Here is the log entry

=0419070000 type=ips subtype=signature pri=alert vd=root serial=117583569 attack_id=8912901 severity=low src=192.168.2.1dst=157.161.9.7 src_port=53 dst_port=51511 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=51511/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 8	 2011-07-18 14:06:10 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117583569 attack_id=8912901 severity=low src=192.168.2.1 dst=157.161.9.7 src_port=53 dst_port=51511 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=51511/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 9	 2011-07-18 14:01:14 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117548501 attack_id=8912901 severity=low src=192.168.2.1 dst=82.117.0.70 src_port=53 dst_port=1032 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=1032/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 10	 2011-07-18 14:01:14 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117548501 attack_id=8912901 severity=low src=192.168.2.1dst=82.117.0.70 src_port=53 dst_port=1032 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=1032/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 11	 2011-07-18 13:58:01 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117524248 attack_id=8912901 severity=low src=192.168.2.1 dst=213.55.128.6 src_port=53 dst_port=51835 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=51835/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 12	 2011-07-18 13:57:51 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117524248 attack_id=8912901 severity=low src=192.168.2.1 dst=213.55.128.6 src_port=53 dst_port=51835 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=51835/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 13	 2011-07-18 13:57:16 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117519605 attack_id=8912901 severity=low src=192.168.2.1 dst=82.144.41.14 src_port=53 dst_port=43577 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=43577/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 14	 2011-07-18 13:57:11 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117519605 attack_id=8912901 severity=low src=192.168.2.1 dst=82.144.41.14 src_port=53 dst_port=43577 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=43577/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 15	 2011-07-18 13:57:02 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117518505 attack_id=8912901 severity=low src=192.168.2.1 dst=212.23.97.3 src_port=53 dst_port=5544 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=5544/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 16	 2011-07-18 13:57:02 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117518505 attack_id=8912901 severity=low src=ydwan1 status=detected proto=17 service=5544/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 17	 2011-07-18 13:54:12 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117497540 attack_id=8912901 severity=low src=192.168.2.1 dst=130.82.89.10 src_port=53 dst_port=26671 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=26671/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 18	 2011-07-18 13:54:05 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117497540 attack_id=8912901 severity=low src=192.168.2.1 dst=130.82.89.10 src_port=53 dst_port=26671 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=26671/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 19	 2011-07-18 13:53:55 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117495449 attack_id=8912901 severity=low src=192.168.2.1 dst=82.212.62.39 src_port=53 dst_port=36700 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=36700/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 20	 2011-07-18 13:53:47 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117495449 attack_id=8912901 severity=low src=192.168.2.13 dst=82.212.62.39 src_port=53 dst_port=36700 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=36700/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 21	 2011-07-18 13:53:25 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117492054 attack_id=8912901 severity=low src=192.168.2.1 dst=218.213.141.50 src_port=53 dst_port=51880 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=51880/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow, repeated 2 times" 
 22	 2011-07-18 13:53:16 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117491815 attack_id=8912901 severity=low src=192.168.2.1 dst=218.213.141.49 src_port=53 dst_port=4959 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=4959/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 23	 2011-07-18 13:53:16 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117491815 attack_id=8912901 severity=low src=192.168.2.1 dst=218.213.141.49 src_port=53 dst_port=4959 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=4959/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 24	 2011-07-18 13:42:15 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117414316 attack_id=8912901 severity=low src=192.168.2.1 dst=212.4.64.139 src_port=53 dst_port=59922 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=59922/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 25	 2011-07-18 13:42:15 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117414316 attack_id=8912901 severity=low src=192.168.2.1 dst=212.4.64.139 src_port=53 dst_port=59922 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=59922/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 26	 2011-07-18 13:40:18 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117399417 attack_id=8912901 severity=low src=192.168.2.1 dst=213.20.173.12 src_port=53 dst_port=58487 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=58487/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 27	 2011-07-18 13:40:09 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117399417 attack_id=8912901 severity=low src=192.168.2.1 dst=213.20.173.12 src_port=53 dst_port=58487 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=58487/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 28	 2011-07-18 13:39:59 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117398273 attack_id=8912901 severity=low src=192.168.2.1 dst=195.50.140.155 src_port=53 dst_port=57353 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=57353/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow" 
 29	 2011-07-18 13:39:59 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=117398273 attack_id=8912901 severity=low src=192.168.2.1 dst=195.50.140.155 src_port=53 dst_port=57353 src_int=dmz1 dst_int=wan1 status=detected proto=17 service=57353/udp user=N/A group=N/A ref=" http://www.fortinet.com/ids/ID8912901"  msg=" dns_decoder: DNS.Name.Overflow"  

The 192.168.2.1 is my (public) DNS Server. Thank you and regards.