Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Cisco ASA Regex that matches a "root" DNS query

Posted on 2010-08-17
11
Medium Priority
?
1,082 Views
Last Modified: 2012-05-10
I am currently under a DDOS DNS attack. It is not clear if I am the victim or an unwilling participant in an attempt to DDOS someone else.

In any event, a query is sent to our DNS server looking for the "root". The DNS server has been configured to ignore the request other wise it would reply with the list of root servers.

I would like to configure our Cisco ASA to block the request at the firewall before it ever reaches the DNS server.

I would like to inspect DNS and check the "Domain Name" field for the root or "." However I can't seem to figure out how to create the Regex that would match when the query just contains the period character.

Can anyone provide assitance?

Thanks
0
Comment
Question by:spencerturbine
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
11 Comments
 
LVL 1

Expert Comment

by:ShattyP
ID: 33456767
To match a literal character, use the \ symbol.
Example, the regex for google.com would be google\.com

So in your case, you would just do \.

regex name \.
0
 
LVL 1

Expert Comment

by:ShattyP
ID: 33456779
0
 

Author Comment

by:spencerturbine
ID: 33456785
This would match any Domain name query:

www.whatever.com - Match would succeed.

I need to match . and only a single .
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 14

Expert Comment

by:anoopkmr
ID: 33456909
try like this example

regex domainlist1 "\.yahoo\.com"
regex domainlist2 "\.myspace\.com"
regex domainlist3 "\.youtube\.com"

class-map type regex match-any DomainBlockList
 match regex domainlist1
 match regex domainlist2
 match regex domainlist3

class-map type inspect http match-all BlockDomainsClass
 match request header host regex class DomainBlockList

policy-map type inspect http http_inspection_policy
class BlockDomainsClass
  reset log


policy-map inside-policy
 class httptraffic
  inspect http http_inspection_policy
service-policy inside-policy interface inside
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33456916
0
 

Author Comment

by:spencerturbine
ID: 33457689
anoopkmr:

This is not really related to what I am looking for... I am not trying to match a full domain name.

I am trying to match a Root DNS query which is a single period. I need to create a RegEx that will match only and instance of a root query. All other querys must fail the RegEx.

I have no problems matching domain names with other Regexs, I only have a problem matching a root dns query.
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33457918
sorry Spencer , i dont have anyother options to help u
0
 
LVL 35

Expert Comment

by:Terry Woods
ID: 33459654
Would:
^\.$
work?
0
 

Author Comment

by:spencerturbine
ID: 33468391
Sorry Terry, that does not appear to work.
0
 
LVL 35

Accepted Solution

by:
Terry Woods earned 2000 total points
ID: 33470159
Interestingly, the $ doesn't appear in the list of special characters for this flavour of regular expressions (I was just hoping it would work anyway) - generally it is used to match the end of the line. Without a negative lookahead function to use instead, it makes it somewhat tricky to tell it not to match any more characters after the . character. This will match only strings starting with a . character:
^\.

There doesn't seem to be anything in the allowed pattern matching that would allow a match of . but not .blah though. You'd need either a negative lookahead or the end of string placeholder ($) to manage that.
0
 

Author Closing Comment

by:spencerturbine
ID: 33475314
I am going to accept you answer as it would appear that you are correct when you say this cannot be done.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
Considering cloud tradeoffs and determining the right mix for your organization.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question