[Bro] DNSSEC Support
bro at pingtrip.com
Wed Apr 27 17:21:39 PDT 2016
It doesn't appear that there is full support for DNSSEC RR types in the current release and I'm looking for the best option in the meantime.
For example, answers that include RRSIG's will produce a vector similar to ["192.168.1.1","<unknown type=46>"] with a corresponding event in weird.log of "DNS_RR_unknown_type".
In protocols/dns/consts.bro I see type 46 is included in the query_type map but based on the variable name I assume its not applied to answers?
More information about the Bro