Files
Paradoxis-DNSRPC-BOF/pcaps/dnsrpc_coerce_write.pcap
T
sud0woodo 29bf86738f Fix PCAP files, truly polish rules
- Fixed IP header in PCAP files for larger packets, coincidentally these packets were all part of the DCERPC bind request. Length for these packets was somehow set to 0, likely something to do with performance during packet capture (suspecting segmentation offloading). Patched in the right length for each of the PCAPs except for the `dnsrpc_probe.pcap` which was fine as is.
- Rewrote rules to add flowbits for the DNSSERVER bind, added threshold and reference
2026-07-03 14:05:14 +03:00

5.9 KiB