What does "Unknown: Malform Packet" in Nebula logs mean, and how is it handled?

Zyxel_Emily

Question:
What does "Unknown: Malform Packet" in Nebula logs mean, and how is it handled?

Answer:
The log message "Unknown: Malform Packet" indicates that DNS Threat Filter has detected a DNS packet that does not conform to the expected format.

A DNS packet is considered malformed under these specific conditions:

• The number of entries in the question count field in the DNS header is 0.
• An error occurs when parsing the domain name in the question field.
• The length of the domain name exceeds 255 characters.

These malformed DNS packets are detected by the DNS Threat Filter service, which is designed to identify and manage potentially harmful or improperly formatted DNS traffic.
Under the "Malform DNS packets" setting, you can define the Action (e.g., drop to block the packet) and whether to Log the event (e.g., log to record it in your event logs). The appearance of "Unknown: Malform Packet" in your logs means that the logging option for malformed DNS packets is enabled.