We have a simple setup: Some workstations (Mac and Linux) and a gateway router. For statistics and security purposes I want to watch all DNS queries done in our intranet. Unfortunately the gateway router is not capable of logging DNS traffic in a sufficient manner. What is the best way to accomplish this?
2 Answers
Setup a DNS server on hardware, and enable logging. Force all your clients to use it with configuration combined with firewall rules blocking clients from access DNS servers other then your DNS server.
@Zoredache's answer is the ideal answer for long term monitoring (and control) but for short term monitoring there is the widely available dnstop(8)
Capturing packets or reading a pcap file, it can display domains broken down by zone level, query and response types, and other fun oddities.
-
I tried dnstop. But I only managed to watch queries of the machine it is running on. How would you watch other hosts in your network?– awadoFeb 25, 2017 at 20:16
-
1Your interface needs to be able to operate in
promiscuous
mode; dnstop will try this by default - possible causes: your driver might not support that mode, or your machine might be separated via a switch. You could trytcpdump
to see if the packets you are expecting are present (dnstop & tcpdump use the same underlying api– peteFeb 25, 2017 at 22:03 -
1Well, finally I had time to test my setup more precisely. It was in deed a matter of the switch. The interface was in promiscuous mode, but the switch did separate its ports. Setting that port to monitor mode gave the desired results in dnstop. Thanks for your good hint! I will have to go Zoredache's way, because dnstop doesn't see all the pakets of all networks on that port. :-(– awadoMar 11, 2017 at 20:33