For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jdtokenring's avatar
jdtokenring
Icon for Nimbostratus rankNimbostratus
Apr 28, 2020

irule to drop null dns queries

Greetings!!!

 

I was curious if anyone else has had to deal with TONS of null queries to their external dns and if you had any luck dropping those? I am trying to get it to do it via an irule but not having much luck. I have checked out lots of different articles but cant seem to get it quite right.

 

I have tried:

when DNS_REQUEST{

if { [DNS::question type] equals "null" } {

DNS::drop

}

}

#and this

when DNS_REQUEST {

if {[DNS::question type] equals "10"} {

DNS::drop

}

}

 

# we also tried using empty rrname

when DNS_REQUEST {

if { [DNS::rrname] equals "" } { <-- this gave an error

DNS::drop

}

}

 

Any ideas on a way to block these effectively? We are running 14.1, and have a ticket open with support. Will post back if they see where we missed it.

No RepliesBe the first to reply