DNS over HTTPS and QUIC monitoring and verification

To monitor and verify DNS traffic for HTTPS and QUIC protocols:

  • Execute show snort counters on the Firewall Threat Defense CLI to view statistics for the modules dns, http_inspect, http2_inspect, http3_inspect, and quic_inspect.

  • Execute show snort counters on the Firewall Threat Defense CLI and monitor the telemetry fields dnsOverUDP, dnsOverTCP,dnsOverHttp1, dnsOverHttp2, dnsOverHttp3, and dnsOverQuic to track the usage of different DNS query methods.