DNS sinkhole configuration for Deep Discovery Inspector (DDI)

The Monitor and Reset action of the domain deny list can inject a predefined IP address in the DNS response packet. The predefined IP address can be configured by doing the following steps:

1. Log on to DDI then go to http://[IP of DDI]/html/rdqa.htm.
2. On the menu, select NCIE-Related.

3. Configure the following entries:

   • DNS redirect for A IP:
   • DNS redirect for A TTL:
   • DNS redirect for AAAA IP:
   • DNS redirect for AAAA TTL:
4. Go back to the DDI management page and select Administration > Monitoring / Scanning > Deny List / Allow List.
5. On the Deny list tab, click Add.
6. To add the domains that you want the sinkhole applied to, select Domain and select type Monitor and reset.
7. Click Save.

The next time the particular domain makes a DNS request, it will be redirected to the DNS redirect specified in the NCIE-Related configuration.