DNS Zone Transfer False Positive

["Ron Shuck" <rshuck () Buchanan com>]

Hi,

I have been getting a few DNS Zone Transfer false positives. They
originate from 2K or XP workstations.
When I examined a little closer, it appeared to be a DNS query
containing a TSIG. The signature
portion of the TSIG additional record contains the content string from
the snort signature |00 00 FC|.

Anyone have any ideas of how to eliminate this type of false positive
from the signature? I would also appreciate
any explanation what the heck this traffic does? I am just looking into
rfc2931 and 2535.

Transmission Control Protocol, Src Port: 2856 (2856), Dst Port: domain
(53), Seq: 3389545719, Ack: 3366544751, Len: 273
Domain Name System (query)
    Length: 271
    Transaction ID: 0xcf88
    Flags: 0x0000 (Standard query)
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...0 .... .... = Recursion desired: Don't do query
recursively
        .... .... ...0 .... = Non-authenticated data OK:
Non-authenticated data is unacceptable
    Questions: 1
    Answer RRs: 1
    Authority RRs: 0
    Additional RRs: 1
    Queries
        9XXXXXXXXXXX-3: type TKEY, class inet
            Name: 9XXXXXXXXXXX-3
            Type: Transaction Key
            Class: inet
    Answers
        9XXXXXXXXXXX-3: type TKEY, class any
            Name: 9XXXXXXXXXXX-3
            Type: Transaction Key
            Class: any
            Time to live: 0 time
            Data length: 136
            Algorithm name: gss.microsoft.com
            Signature inception: Mar  3, 2003 08:01:36.000000000
            Signature expiration: Mar  4, 2003 08:01:36.000000000
            Mode: GSSAPI
            Error: No error
            Key
            Other
    Additional records
        9XXXXXXXXXXX-3: type TSIG, class any
            Name: 9XXXXXXXXXXX-3
            Type: Transaction Signature
            Class: any
            Time to live: 0 time
            Data length: 51
            Algorithm name: gss.microsoft.com
            Time signed: Mar  3, 2003 08:01:36.000000000
            Fudge: 36000
            Signature
            Original id: 53128
            Error: No error
            Other


Best Regards,


Ron Shuck, CISSP - Managing Consultant 
Buchanan Associates - A Technology Company in the People Business 
http://www.buchanan.com 
http://www.isc2.org

Attachment: smime.p7s
Description: