Rule: 

--
Sid: 
100000161

-- 
Summary: 
This event is generated when an abnormally larger number of unresolvable DNS 
queries are generated by a particular host.

--
Impact:
This can be an indication of a denial of service attack in progress.

--
Detailed Information:
Since SIP systems can be overwhelmed by being forced to deal with an overly 
large number of invalid hostnames, this rule is designed to detect such attacks 
by searching for large volumes of DNS responses which contain the message "No 
such name".

--
Affected Systems:
Any which implement the SIP protocol.

--
Attack Scenarios:
An attacker could use a script to flood a system with requests from invalid 
hosts, causing a denial of service.

--
Ease of Attack:
Simple, as it is trivial to write a script to generate requests with invalid 
hostnames.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Use a firewall or other access-restriction device to block unwanted messages at 
your network's border.

--
Contributors:
Jiri Markl <jiri.markl@nextsoft.cz>
Sourcefire Research Team

--
Additional References
Other:

--
