[Intelmq-users] Reverse DNS Expert - unusual behavior

[Tomislav Protega]

Hi Sebastian,

we are still on older version of IntelMQ (1.1.0 - dev).
As I said, there are no errors in logs during the DNS lookup.

When I noticed that, for example, for Shadowserver reports,
I opened its .csv file and start to compare the lines from origin input
and those one on the ouput, whether it was to a local file or ELK.
If one line in .csv file doesn't have hostname value, the reverse DNS
bot takes hostname value from other line within the same processed .csv
file and applies to the one which doesn't have.


Regards,

--
Tomislav



On 12. 12. 2019. 15:25, Sebastian Wagner wrote:
> Hi Tomislav,
> 
> That's very weird. My first question is of course: Which version of
> IntelMQ are you using? Do the logs of the bot indicate any DNS lookup
> errors?
> 
> Sebastian
> 
> On 12/12/2019 10.18, Tomislav Protega wrote:
>> Hi,
>>
>> recently I noticed that reverse DNS expert bot doesn't correctly apply
>> the reverse lookup results for IP. Meaning, the right value (result) is
>> not applied for the right JSON event. It's like it's skipping it and
>> then applies it to other event. There are no errors in log file for the bot.
>>
>> For the illustration:
>> Let say that hostname for IP 1.1.1.1 is "xx.yyy.zz", but
>> instead the mentioned hostname becomes applied under wrong JSON event
>> for the IP which in real has no PTR record in DNS.
>>
>> Of course, there are events which have applied right PTR record for the
>> IP, but in rare situations.
>>
>> This case is not the issue with raw events which already contain
>> hostname in origin feed.
>>
>> Anyone notice such behavor, or could take a look at already processed
>> data and see if the "source.reverse_dns" has right value applied against IP?
>>
>>
>> Regards,
>>