At a university, traffic that looks like DNS carries a second protocol inside it, and the intrusion-detection rule for that inner protocol never fires. What is the visibility impact?
Select an answer to reveal the explanation.
Short Explanation
A note folded inside a menu can slip past a guard who only reads the cover. The inner protocol is tunneled inside traffic that looks like DNS, so your rule for the clear protocol never matches. Address translation, a copying tap, and load balancing do not hide a protocol that way.
Full Explanation
The IDS rule is written for the inner protocol in the clear, and that protocol is riding inside traffic that looks like DNS, so the pattern the rule expects is not where the rule looks. DNS tunneling that hides the inner protocol from a rule written for that protocol in the clear is the impact. Address translation that changes the campus source address and still leaves the inner protocol in the clear would rewrite an address and would leave a clear protocol visible to the rule. A network tap that drops the inner packets so the IDS never receives the tunneled traffic misstates a tap: a tap copies traffic and cannot drop the original packet, so it does not remove the inner protocol. Load balancing that duplicates the inner protocol across servers so the clear-text rule should fire more often would spread or copy traffic and would not explain a rule that never matches. Exam caveat: the rule matches the protocol it was written to see in the clear, and encapsulation means that pattern is no longer sitting in the clear where the rule looks. Operational check: inspect the DNS payload for a second protocol and compare it with the rule that expected that protocol in the clear.