I currently have the following DNS Query Alert rule set up in Suricata (for test purposes):

 alert dns any any -> any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;)

Which is triggered when it captures DNS events which contain the word "google", such as in this packet:


However, instead of searching for resource record names that contain "google", I want to use this same kind of alert to trigger on IP addresses that resolve to loopback, as is the case with the following packet (Notice the rdata field):


As I have noticed, the contentsection of a Suricata rule searches only for a string. My current rule triggers on a text match with the rrname/domain, how would I make it so that the rule triggers on rdata/IP address?

p.s. Just out of curiosity I tried replacing the "google" in the content section of my alert with "" and that didn't work either, as expected.


1 Answer 1


The ip address is just a 32 bit number. In the rule the IP should be represented as a hex value and not a string, for purposes of efficiency and saving bandwidth (a string will be 8+ bytes as opposed to 4 bytes).

Here is my final Suricata rule to alert whenever somebody gets sent to loopback on my network:

alert dns any any -> any any (msg:"BLACKLISTED DOMAIN"; content:"|7F 00 00 01|"; sid:1;)

Not the answer you're looking for? Browse other questions tagged or ask your own question.