anti 35159419bb feat(dns): detect CLASS=ANY queries as fingerprint_probe ...

qclass=255 in a standard query is unusual enough to be a fingerprinting probe
(fpdns, various scanner scripts).  Previously it was logged as a plain query
with qclass=ANY in the event field; now it emits fingerprint_probe with
probe=qclass_any and returns REFUSED — consistent with how we treat other
probe types.  Contributes to recon_burst.

2026-05-21 21:16:47 -04:00

37 KiB

Raw Blame History

View Raw