gistfile1.bro

module DNSLongQuery;

export {
        redef enum Notice::Type += {
            DNS_LongQuery,
        };
        const blacklist_dns_qtypes: set[string] = { "TSIG", "IXFR", "TXT", "NSEC", "AXFR", "TKEY", "SIG", "EDNS", "KEY", "DNSKEY", "SOA", "SPF", "RRSIG" };
}

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)
{
    if ( DNS::query_types[qtype] in blacklist_dns_qtypes )
        return;
    if ( |query| > 1024 ) {
        NOTICE([$note=DNS_LongQuery,
            $msg=fmt("%s received a long DNS query over 1024 bytes", c$id$resp_h),
            $sub=query,
            $uid=c$uid,
            $id=c$id,
            $identifier=cat(c$id$orig_h)]);
    }
}