0

I have a suspicious program on my Linux box I would like to filter specifically DNS packets requests and response.

I know there is wireshark but I would prefer a command line. in which I can filter majorly dns related packets outgoing and incoming.

How do I solve this?

Improve this question

2 Answers 2

Reset to default
1

Have you tried just using tcpdump -i <interface name> -vv port 53 it will capture all dns coming from the server, depending on what you have running, that may work.

Are you able to set the interface or IP that the java program uses? If you can then you can use filters on tcpdump to restrict to just that IP.

If you need to add another IP to an interface, ip add 192.168.55.55/32 dev eth0 replacing the ip and dev name to match your setup.

If you can set the interface, you can also create a private vlan by:

ip link add link eth0 <name of link> type vlan id 10 changing the id and interface to match your setup. If you need external access for the program, sysctl net.ipv4.conf.eth0.forwarding this will enable forwarding on your interface for the current session, if you set the IP for the link as a /32 address, then the forwarding should work.

Similar to a link, add a tap device ip link add link eth0 <name of tap> type tap and the same applies above with forwarding and IP address.

If you can get it on its own ip or interface then:

own interface: tcpdump -i <interface name> -n -p -vv port 53 the -n will stop dns lookups and display the results quicker, and the -p stops promisc (receives all packets on the physical interface even if it not mode that is default for tcpdump and finally -vv for verbose so it shows the data in the packet.

own IP: tcpdump -i <interface name> -n -p port 53 host <ip address> with the IP being the ip for the java program and interface to match your local setup.

Improve this answer
0

strace would be the best program for that.

if the process is already running, do ps aux and get the pid for the process.

then run strace -f -e trace=network -s 1500 -p <pid here>

The -s 1500 is to print the full packet, assuming you mtu is the standard 1500, if there are large udp packets you can use -s 10000, but if they are just dns packets, 1500 should be enough.

If the process is not running then: strace -f -e trace=network -s 1500 cmd with arguments;

Improve this answer
1
  • thanks, I already tried strace but it's a large java program that would be bugged down while using strace to trace the network packet, if you have another option.
    – geek
    Commented Dec 27, 2022 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .