Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to filter out logs to look for suspicious outbound traffic to external websites. On the DNS server I can setup debug logging, but I don't see a way to view the originating source of the computer making the DNS request to the server. Is there a way to capture this data to learn the source IP address of DNS requests arriving at my server?

share|improve this question
Unfortunately, product recommendations are off-topic. Protip: look at Splunk for log affregation and use an outbound shaper/proxy like WebSense or BlueCoat that can make nice neat reports for things like this. – MDMarra Jul 17 '12 at 15:08
Thanks Marra. I should've been more specific and just asked if anyone has seen an option in the Debug feature of 2008 for source IPs :) – RomeNYRR Jul 17 '12 at 15:13
@MDMarra: I'm having a hard time seeing this one as "product recommendation". It sounds a lot more like "what program / tool can I use to do this?" – Evan Anderson Jul 17 '12 at 15:25
@EvanAnderson Maybe I'm misunderstanding the intent of the question, but "what tool should I use" is generally considered shopping/product rec territory. – MDMarra Jul 17 '12 at 15:28
@MDMarra: Perhaps I've lost touch w/ the "community norms" a little bit, then, being away from daily participation in the site for so long. Offering up a suggestion of an operating system feature, open source tool, or even a commercial tool to a question of "What can do this job?" doesn't strike me as product recommendation. Product recommendation, to me, is more like a question that asks "Of products x, y, and z, which one do you recommend to do task A?" – Evan Anderson Jul 17 '12 at 15:40
up vote 9 down vote accepted

I'd consider using Wireshark or Microsoft's Network Monitor with a capture filter of sufficient granularity to limit capture to the DNS traffic you're looking for. Once you've got the data captured you can go back and perform analysis.

I'd probably use the tshark command-line program in Wireshark to capture traffic into relatively small files, then use tshark again on another machine to dump the files and grep through them. A capture command line might be something like:

tshark -i <inteface number here> -b filesize:32768 -w dns_capture udp and dst port 53 and dst host x.x.x.x

You can get your machine's interface number using tshark -D. The -b filesize:32768 argument specifies capturing into a buffer of 32,768KB (32MB) before starting a new capture file. The -w dns_capture specifies a base output filename of dns_capture (which will have an incremental count and timestamp added as each file fills). The udp and dst port 53 and dst host x.x.x.x is a tcpdump capture filter that specifies that only udp packets with destination port 53 and a destination address of x.x.x.x (where you should substitute the DNS server's IP address) will be captured.

Once you've got the files you could use any number of PCAP file analysis tools. Personally, I'd just use tshark with the -r argument to read files and dump them out as human-readable text using the -T text argument. Then I'd just grep the output. (I'd do this mainly because I have all the tools ready to go. There are lots of other ways you could do it, too.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.