3

We have a simple setup: Some workstations (Mac and Linux) and a gateway router. For statistics and security purposes I want to watch all DNS queries done in our intranet. Unfortunately the gateway router is not capable of logging DNS traffic in a sufficient manner. What is the best way to accomplish this?

  • What make/model/version of router? – Aaron Feb 22 '17 at 23:51
  • I'd prever a router indepent way, as that may vary and the solution might be suitable for a bigger audience. – awado Feb 25 '17 at 20:13
  • In that case I would go with @Zoredache answer – Aaron Feb 26 '17 at 2:02
4

Setup a DNS server on hardware, and enable logging. Force all your clients to use it with configuration combined with firewall rules blocking clients from access DNS servers other then your DNS server.

4

@Zoredache's answer is the ideal answer for long term monitoring (and control) but for short term monitoring there is the widely available dnstop(8)

Capturing packets or reading a pcap file, it can display domains broken down by zone level, query and response types, and other fun oddities.

  • I tried dnstop. But I only managed to watch queries of the machine it is running on. How would you watch other hosts in your network? – awado Feb 25 '17 at 20:16
  • 1
    Your interface needs to be able to operate in promiscuous mode; dnstop will try this by default - possible causes: your driver might not support that mode, or your machine might be separated via a switch. You could try tcpdump to see if the packets you are expecting are present (dnstop & tcpdump use the same underlying api – pete Feb 25 '17 at 22:03
  • 1
    Well, finally I had time to test my setup more precisely. It was in deed a matter of the switch. The interface was in promiscuous mode, but the switch did separate its ports. Setting that port to monitor mode gave the desired results in dnstop. Thanks for your good hint! I will have to go Zoredache's way, because dnstop doesn't see all the pakets of all networks on that port. :-( – awado Mar 11 '17 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.