35

How can I create logs of every DNS query that my computer makes along with the responses it gets?

Improve this question

7 Answers 7

Reset to default
21

You can have tcpdump log all port 53 UDP and TCP activity.

Improve this answer
5
  • 9
    Any details on how?
    – e-sushi
    Feb 5, 2016 at 17:57
  • This is the best answer as we can't be sure the OP (or other readers) have access to the DNS server - only their local machine. To answer @e-sushi's question take a tcpdump using the utility (check out the man page or a good primer with examples). Your best bet is to dump to a file and then pull that data into wireshark for review & analysis.
    – James Shewey
    Apr 5, 2017 at 16:04
  • 1
    github.com/gamelinux/passivedns seems to be doing just that, see ./doc/How-it-works.txt
    – mxmlnkn
    Jan 12, 2018 at 21:10
  • 13
    tcpdump udp port 53
    – Brannon
    Mar 13, 2018 at 4:48
  • 3
    It may not select the outbound network interface by default, so you need a bit more: tcpdump --list-interfaces, tcpdump udp port 53 --interface (pickone). Also consider verbosity: -vv
    – Brent Bradburn
    May 17, 2019 at 20:08
13

To show and save to file all the A DNS requests, run this:

script -q -c "sudo tcpdump -l port 53 2>/dev/null | grep --line-buffered ' A? ' | cut -d' ' -f8" | tee dns.log

Example output:

google.com.
wikipedia.org.

UPDATE (2023): output format of tcpdump changed; domain name is in field #9, not #8.

Fixed one-liner:

script -q -c "sudo tcpdump -l port 53 2>/dev/null | grep --line-buffered ' A? ' | cut -d' ' -f9" | tee dns.log
Improve this answer
4
  • 1
    This command worked for me, but I don't understand why script is needed. Could you explain?
    – Dagang
    Jul 16, 2021 at 17:39
  • Will print responses with implicit request info on a single line: sudo tcpdump -vvli eth0 port 53 | grep --line-buffered " q: A? " | cut -d' ' -f16-
    – Matteljay
    Aug 27, 2021 at 12:52
  • This just prints out a bunch of lines that say A?
    – Herohtar
    Jan 18 at 15:29
  • 2
    @Herohtar the output format of tcpdump has been changed. Now domain name is in field #9, not #8. Try script -q -c "sudo tcpdump -l port 53 2>/dev/null | grep --line-buffered ' A? ' | cut -d' ' -f9" | tee dns.log
    – Vanni
    Jan 19 at 0:18
11

The easiest way is to install Bind locally. Most distros default install of Bind will be non-autoritative caching-only.

Simply add a logging {} config block (as described in the Bind 9 Configuration Reference) then set your system to use 127.0.0.1 or ::1 as the DNS resolver.

Improve this answer
3
  • 2
    Given how large bind is and its lackluster security record, I think many people would hesitate to install something like that for the sole purpose of logging.
    – jw013
    Jul 23, 2012 at 1:16
  • doesn't bind have the issue that the nameservers in /etc/resolv.conf are not used but nameservers must be listed explicitly in the bind config?
    – Bananguin
    Jul 23, 2012 at 7:12
  • No. /etc/resolv.conf is the system resolver list. Bind's default configuration is to look up the authoritative name servers and ask them. You could forward all requests to a specific server (or set, such as your ISP, OpenDNS or Google Public DNS) but it's not required to do so in the config. I do this all the time. I can't even count the number of times I've set up caching only name servers.
    – bahamat
    Jul 23, 2012 at 15:19
6

dnsmasq is far easier to configure as a DNS aggregator/caching daemon than BIND, and for that purpose, the performance might just be better. If you turn logging up to "debug", all the questions and answers show up in whatever syslog has configured for debug messages.

Dnsmasq also makes it easy to get rid of abusive advertisers and dirtbag privacy invading "analytic" creeps by aliasing entire domains to 127.0.0.1

Improve this answer
1
2

One easy way to filter the DNS , for the requests you are interested in is to grep the next row too grep -A 2 where -A is after and 2 rows after . If the server has a lot of DNS requests increase from 2 to 4-5

tcpdump -l port 53 |grep -A 2  redis

the second line will be the answer from DNS -> IP, CNAME ,none , other

Improve this answer
0

If I recall correctly Snort can selectively monitor traffic based on user defined rules. However, Snort will not create logs for DNS requests when your computer, i.e. its resolver, can answer the question from its cache.

Improve this answer
0

Please try PassiveDNS - A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring (NSM) and general digital forensics.

To make it simple to use, I created a docker image called vimagick/passivedns

version: "3.8"
services:
  passivedns:
    image: vimagick/passivedns
    command: >
      -d "||"
      -i eth0
      -l /var/log/passivedns/passivedns.log
      -L /var/log/passivedns/passivedns-nx.log
      -p /var/run/passivedns.pid
      -P 86400
      -S 256
      -X 46CDNOPRSTMnx
    volumes:
      - ./data:/var/log/passivedns
    network_mode: host
    privileged: true
    restart: unless-stopped

Up and running:

# assume your iface name is eth0
$ ifconfig eth0

$ mkdir passivedns
$ cd passivedns

# paste yaml content here
$ vim docker-compose.yml

$ docker compose up -d

$ tail -f data/passivedns.log

Example output:

#timestamp||dns-client ||dns-server||RR class||Query||Query Type||Answer||TTL||Count
1322849924.408856||10.1.1.1||8.8.8.8||IN||upload.youtube.com.||A||74.125.43.117||46587||5
1322849924.408857||10.1.1.1||8.8.8.8||IN||upload.youtube.com.||A||74.125.43.116||420509||5
1322849924.408858||10.1.1.1||8.8.8.8||IN||www.adobe.com.||CNAME||www.wip4.adobe.com.||43200||8
1322849924.408859||10.1.1.1||8.8.8.8||IN||www.adobe.com.||A||193.104.215.61||43200||8
1322849924.408860||10.1.1.1||8.8.8.8||IN||i1.ytimg.com.||CNAME||ytimg.l.google.com.||43200||3
1322849924.408861||10.1.1.1||8.8.8.8||IN||clients1.google.com.||A||173.194.32.3||43200||2
Improve this answer

You must log in to answer this question.