4

We have a simple setup: Some workstations (Mac and Linux) and a gateway router. For statistics and security purposes I want to watch all DNS queries done in our intranet. Unfortunately the gateway router is not capable of logging DNS traffic in a sufficient manner. What is the best way to accomplish this?

3
  • What make/model/version of router?
    – Aaron
    Feb 22, 2017 at 23:51
  • I'd prever a router indepent way, as that may vary and the solution might be suitable for a bigger audience.
    – awado
    Feb 25, 2017 at 20:13
  • In that case I would go with @Zoredache answer
    – Aaron
    Feb 26, 2017 at 2:02

2 Answers 2

4

Setup a DNS server on hardware, and enable logging. Force all your clients to use it with configuration combined with firewall rules blocking clients from access DNS servers other then your DNS server.

4

@Zoredache's answer is the ideal answer for long term monitoring (and control) but for short term monitoring there is the widely available dnstop(8)

Capturing packets or reading a pcap file, it can display domains broken down by zone level, query and response types, and other fun oddities.

3
  • I tried dnstop. But I only managed to watch queries of the machine it is running on. How would you watch other hosts in your network?
    – awado
    Feb 25, 2017 at 20:16
  • 1
    Your interface needs to be able to operate in promiscuous mode; dnstop will try this by default - possible causes: your driver might not support that mode, or your machine might be separated via a switch. You could try tcpdump to see if the packets you are expecting are present (dnstop & tcpdump use the same underlying api
    – pete
    Feb 25, 2017 at 22:03
  • 1
    Well, finally I had time to test my setup more precisely. It was in deed a matter of the switch. The interface was in promiscuous mode, but the switch did separate its ports. Setting that port to monitor mode gave the desired results in dnstop. Thanks for your good hint! I will have to go Zoredache's way, because dnstop doesn't see all the pakets of all networks on that port. :-(
    – awado
    Mar 11, 2017 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .