[Snort-sigs] DNS Spoof probably has false positive

Rule:  DNS SPOOF query response with TTL of 1 min. and no authority
--
Sid:   1:254
--
False Positives: dnsmasq uses low ttl for /etc/hosts records :

==== extracted from man dnsmasq ====
       -T, --local-ttl=<time>
              When  replying  with  information  from /etc/hosts or the 
DHCP leases file dnsmasq by default sets the time-to-live field to zero, 
meaning that the
              requestor should not itself cache the information. This 
is the correct thing to do in almost all situations. This option allows 
a time-to-live  (in
              seconds)  to  be  given  for  these  replies. This will 
reduce the load on the server at the expense of clients using stale data 
under some circum-
              stances.

=====================================


-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs