I'm trying to filter out logs to look for suspicious outbound traffic to external websites. On the DNS server I can setup debug logging, but I don't see a way to view the originating source of the computer making the DNS request to the server. Is there a way to capture this data to learn the source IP address of DNS requests arriving at my server?
I'd consider using Wireshark or Microsoft's Network Monitor with a capture filter of sufficient granularity to limit capture to the DNS traffic you're looking for. Once you've got the data captured you can go back and perform analysis.
I'd probably use the
You can get your machine's interface number using
Once you've got the files you could use any number of PCAP file analysis tools. Personally, I'd just use