Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add note about gating the DNS module. #1120

Merged
merged 2 commits into from
Sep 24, 2024
Merged

add note about gating the DNS module. #1120

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2942b4d
Merge pull request #1118 from gravwell/dev
kris-watts-gravwell Sep 20, 2024
bc43499
add note about gating the DNS module.
david-fritz-gravwell Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions search/dns/dns.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@
The `dns` module can generate an enormous amount of network traffic to your DNS resolver. DNS resolvers may ban you if you generate too many requests in a short amount of time.
```

```{note}
The `dns` module will be disabled if the global configuration `Disable-Network-Script-Functions` is set to true.
```

The `dns` module is used to perform DNS lookups on hostnames and store the result in an enumerated value. The `dns` module can also perform reverse lookups on IP addresses. By default the `dns` module will perform no more than 1024 lookups in a given search. This is to prevent DNS query bursts to your resolver. The module keeps a simple least recently used (LRU) cache of results, so searches with many duplicate values may be well under the lookup limit. You can adjust this limit with the `-l` flag.

The syntax simply takes one or more pairs of values, an enumerated value to perform the lookup on, and a target enumerated value to produce. For example, to perform a lookup on the EV "Computer", generating the result IP in an EV "ip":
Expand Down