alert udp any any -> $HOME_NET 53 (msg:"ET CURRENT_EVENTS NS query for a single dot, possible ddos"; content:"|01 00 00 01 00 00 00 00 00 00 00 00 02 00 01|"; threshold:type limit, track by_src, count 1, seconds 600; classtype:attempted-dos; reference:url,isc.sans.org/diary.html?storyid=5713; reference:url,doc.emergingthreats.net/bin/view/Main/2009030; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DNS_dot; sid:2009030; rev:3;)

Added 2009-02-28 21:25:13 UTC

alert udp any any -> $HOME_NET 53 (msg:"ET CURRENT_EVENTS NS query for a single dot, possible ddos"; content:"|01 00 00 01 00 00 00 00 00 00 00 00 02 00 01|"; threshold:type limit, track by_src, count 1, seconds 600; classtype:attempted-dos; reference:url,isc.sans.org/diary.html?storyid=5713; reference:url,doc.emergingthreats.net/bin/view/Main/2009030; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DNS_dot; sid:2009030; rev:3;)

Added 2009-02-28 21:25:13 UTC

alert udp any any -> $HOME_NET 53 (msg:"ET CURRENT_EVENTS NS query for a single dot, possible ddos"; content:"|01 00 00 01 00 00 00 00 00 00 00 00 02 00 01|"; threshold:type limit, track by_src, count 1, seconds 120; classtype:attempted-dos; reference:url,isc.sans.org/diary.html?storyid=5713; reference:url,doc.emergingthreats.net/bin/view/Main/2009030; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DNS_dot; sid:2009030; rev:2;)

Added 2009-02-06 19:00:54 UTC

alert udp any any -> $HOME_NET 53 (msg:"ET CURRENT_EVENTS NS query for a single dot, possible ddos"; content:"|01 00 00 01 00 00 00 00 00 00 00 00 02 00 01|"; threshold:type limit, track by_src, count 1, seconds 120; classtype:attempted-dos; reference:url,isc.sans.org/diary.html?storyid=5713; reference:url,doc.emergingthreats.net/bin/view/Main/2009030; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DNS_dot; sid:2009030; rev:2;)

Added 2009-02-06 19:00:54 UTC

alert udp any any -> $HOME_NET 53 (msg:"ET CURRENT_EVENTS NS query for a single dot, possible ddos"; content:"|01 00 00 01 00 00 00 00 00 00 00 00 02 00 01|"; threshold:type limit, track by_src, count 1, seconds 120; classtype:attempted-dos; reference:url,isc.sans.org/diary.html?storyid=5713; sid:2009030; rev:1;)

Added 2009-01-20 00:15:30 UTC