Describe the enhancement:
In some cases we see fragmented UDP packets in packetbeat, for example when DNS responses are sent over UDP with EDNS0. Currently packetbeat does not reconstruct fragmented UDP packets (integrations are missing this as well). In the case of DNS monitoring, this means that large DNS responses using EDNS0 are not ingested and indexed.
Describe a specific use case for the enhancement or feature:
Using packetbeat to monitor a node that supports DNS lookups on the internet. EDNS0 requests were being recorded by packetbeat but the responses were missing. Attackers use EDNS0 for reflection/amplification attacks. We would like to use packetbeat to help us determine what DNS records are being used in the wild. The capability to record this interaction will help enhance the service we offer.
Describe the enhancement:
In some cases we see fragmented UDP packets in packetbeat, for example when DNS responses are sent over UDP with EDNS0. Currently packetbeat does not reconstruct fragmented UDP packets (integrations are missing this as well). In the case of DNS monitoring, this means that large DNS responses using EDNS0 are not ingested and indexed.
Describe a specific use case for the enhancement or feature:
Using packetbeat to monitor a node that supports DNS lookups on the internet. EDNS0 requests were being recorded by packetbeat but the responses were missing. Attackers use EDNS0 for reflection/amplification attacks. We would like to use packetbeat to help us determine what DNS records are being used in the wild. The capability to record this interaction will help enhance the service we offer.