Skip to content

IP v6 arpa request are showing up in the "exploded dns" report #709

@nighttardis

Description

@nighttardis

While testing RITA, I started noticing that ip6.arpa requests were showing up in the "exploded dns" report, where 'in-addr.arpa' requests were not. This appears to just be an oversight while coding the filters.

How to reproduce: Run RITA against Zeek DNS logs containing IP v6 arpa lookups.

RITA version: 4.4.0

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions