I'm trying to filter out logs to look for suspicious outbound traffic to external websites. On the DNS server I can setup debug logging, but I don't see a way to view the originating source of the computer making the DNS request to the server. Is there a way to capture this data to learn the source IP address of DNS requests arriving at my server?
Monitor Outbound DNS (Website) Traffic
loggingwindows-server-2008
Related Topic
- Create a IPSEC rule between two servers and still allow normal external traffic
- Wireshark filter to only capture Incoming Packets
- Windows – DNS recursion is insecure, but necessary for internal applications
- Prevent Apache2 from logging robots and image requests
- Windows Advanced Firewall – adding Authorized Computers breaks rule
- Bind Requested DNS Server IP Log
Best Answer
I'd consider using Wireshark or Microsoft's Network Monitor with a capture filter of sufficient granularity to limit capture to the DNS traffic you're looking for. Once you've got the data captured you can go back and perform analysis.
I'd probably use the
tsharkcommand-line program in Wireshark to capture traffic into relatively small files, then usetsharkagain on another machine to dump the files and grep through them. A capture command line might be something like:You can get your machine's interface number using
tshark -D. The-b filesize:32768argument specifies capturing into a buffer of 32,768KB (32MB) before starting a new capture file. The-w dns_capturespecifies a base output filename ofdns_capture(which will have an incremental count and timestamp added as each file fills). Theudp and dst port 53 and dst host x.x.x.xis a tcpdump capture filter that specifies that only udp packets with destination port 53 and a destination address ofx.x.x.x(where you should substitute the DNS server's IP address) will be captured.Once you've got the files you could use any number of PCAP file analysis tools. Personally, I'd just use
tsharkwith the-rargument to read files and dump them out as human-readable text using the-T textargument. Then I'd just grep the output. (I'd do this mainly because I have all the tools ready to go. There are lots of other ways you could do it, too.)