How to drop DNS requests for banned sites?

[golly_wog]

Hi

I'm looking to create a number of signatures to drop DNS requests for banned sites, the only way I've successfully implemented this is creating a signature (string UDP), to drop any UDP/53 traffic containing the regex string of banned site.

I would like clarification from any experts to verify that this is the only way of acheiving this, I know that there's a Service DNS Engine, but I can't seem to specify the FQDN within this. I'm not sure if I'm missing something?

Many thanks

[rhermes · Accepted solution]

You're on the right track. A custom UDP signature is the only way you'll find the requests you want to drop.

The DNS engine does not allow for custom string matches.

- Bob