Iptables – how to monitor traffic at port 53 (DNS)

iptablestcpdumpubuntu-10.04

I am a bit confused with the abundant tcpdump tutorials on internet.
I am having a few of the virtual machines running on a virtualization server.Where I am debugging a problem.Port 53 is the one in problem.
I have a bridged setup where out of 4 LAN cards on the machine in question one is active and it is xen-br0
I want to check if there is any request coming on port 53 on the server by other machines on LAN in question. I also want to see if the guest operating systems on LAN or any other machine is sending traffic at port 53.Due to abundant messages being generated via tcpdump I am finding it difficult to grep the output at desired port.

So how can I use it if some one can give an example that would be helpful.
Thanks in advance.

Best Answer

You can use this command: tcpdump -n -s 1500 -i eth0 udp port 53 (Replace 'eth0' with the name of your ethernet interface, e.g. 'fxp0') This shows all packets going in and out of your machine for UDP port 53 (DNS) Source:DNS exercise 1

Related Solutions

Iptables – Redirect All Incoming Traffic from Secondary Public IP to Internal IP

You will need a combination of DNAT and SNAT, and you need ip_forwarding active.

First, check ip_forwarding:

cat /proc/sys/net/ipv4/ip_forward

If it is 1 (enabled), go ahead. If not, you will have to put net.ipv4.ip_forward=1 on /etc/sysctl.conf and run sysctl -p.

The first rule is DNAT (assume 8.8.8.8 as the external IP and 192.168.0.10 as the internal):

iptables -t nat -A  PREROUTING -d 8.8.8.8 -j DNAT --to-destination 192.168.0.10

When a external system (e.g. 200.100.50.25) sends a packet reaching 8.8.8.8 will have the DESTINATION changed to 192.168.0.10, and sent away. But the source will be 200.100.50.25, the packet will be processed and the response packet can:

Be dropped by 192.168.0.10 that may not know how to route it. Not desirable.
Be sent by 192.168.0.10 to the default gateway and to internet. As soon as it reaches 200.100.50.25, this system will had never heard of 192.168.0.10 and will drop the packet. Not good.
Be dropped on the first hop, as 192.168.0.10 is a private address and not routeable on Internet.

To solve this, you need the second rule, SNAT:

iptables -t nat -A POSTROUTING -s 192.168.0.10 -j SNAT --to-source 8.8.8.8

With this rule, every packet that comes from 192.168.0.10 will have the source changed to 8.8.8.8 and sent away.

The collateral effect is that every log on 192.168.0.10 will show 8.8.8.8 as the client, not the real client. Tracking abusers will be a little harder.

Best Answer

Related Solutions

Iptables – Redirect All Incoming Traffic from Secondary Public IP to Internal IP

Related Topic