FireBall
asked on
Watch DNS requests
Is there any software that show and log the dns query's from TCPdump or sth like that on cent os?
We have a cent os server which is just a transparent bridge on UDP 53 port's trafic. So we want to trace the requests on this server from tcpdump is it possible ?
We have a cent os server which is just a transparent bridge on UDP 53 port's trafic. So we want to trace the requests on this server from tcpdump is it possible ?
ASKER
no i want to see sth like tshark result
source ip
destination ip
requested record (like google.com)
source ip
destination ip
requested record (like google.com)
You can try:
tcpdump -s 0 -t -v -n port 53
This will show you in real time anything for port 53. It will show source and destination IP address and what the query request and response was.
I assumed you wanted the output saved to a file, so I assumed you were going to use the -w option and write the capture to a file to look at later.
tcpdump -s 0 -t -v -n port 53
This will show you in real time anything for port 53. It will show source and destination IP address and what the query request and response was.
I assumed you wanted the output saved to a file, so I assumed you were going to use the -w option and write the capture to a file to look at later.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
try wireshark for once, it has user friendly output.
TY/SA
TY/SA
You can limit tcpdump to just capturing udp and tcp port 53 to limit the amount of data you capture.