LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-29-2015, 02:41 PM   #1
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Rep: Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162
Monitoring DNS Queries


I am reconfiguring my home LAN to use a single local DNS server for all DNS queries rather than each system perform queries.

How do I validate all systems are using only the local DNS server?

My local DNS server (192.168.1.2) is using dnsmasq. The dnsmasq log shows everything to be working as I expected.

My client test system's (192.168.1.6) resolv.conf:

nameserver 127.0.0.1
nameserver 192.168.1.2

My test system is not experiencing any hangs or delays. After a short web browser session the server dnsmasq log shows many query requests from the IP address of my test system. A good sign but inconclusive.

To my understanding, the Linux resolver is limited to resolv.conf addresses. I presume then all DNS queries are limited to those two IP addresses. So perhaps that design itself is all the validation I need. Nonetheless, would be nice to monitor something at the test system to validate each query is going only to 192.168.1.2.

How do I verify the test system (192.168.1.6) is only using 192.168.1.2 for dns queries?

Thanks.
 
Old 11-29-2015, 05:45 PM   #2
berndbausch
LQ Addict
 
Registered: Nov 2013
Location: Tokyo
Distribution: Mostly Ubuntu and Centos
Posts: 6,316

Rep: Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002
It's hard to exclude improbable border cases, such as a process doing its own name resolution without using the resolver. If your concern is DNS queries, though, you could trace network packets with port 53.

Another option might be writing your own gethostbyname as a front end to to the standard library function that monitors this.
 
Old 11-30-2015, 01:57 AM   #3
lambo69
Member
 
Registered: Sep 2012
Distribution: Slackware, Manjaro, Slackarm, Raspbian, Debian
Posts: 68

Rep: Reputation: Disabled
Try Wireshark or tcpdump.
 
Old 11-30-2015, 06:56 AM   #4
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,748
Blog Entries: 11

Rep: Reputation: 233Reputation: 233Reputation: 233
You can only verify it at the gateway level. Or maybe at the switch level when you mirror the traffic of a certain port.
As allready pointed out the usage of your local dns server is no guranteed sign that its the only dns server used by the client. You would need to monitor the traffic on the udp and tcp ports 53. Also this is no 100 guarantee for no other dns server beeing used. But it tackles the default ports and protocol of dns. 100% assurance can only be given if you monitor all network traffic and search for dns protocol packets. Which could be hard in case of ssl traffic.

On the client side you should trust the configuration settings. Also this would not hold back an application to not tolerate this setting. Maybe install some firewall rules that allows dns protocol to only communicate with your local dns server.
Quote:
iptables -p udp --dport 53 -d 192.168.1.2 -j ACCEPT
iptables -p tcp --dport 53 -d 192.168.1.2 -j ACCEPT
iptables --dport 53 -j REJECT
 
Old 11-30-2015, 11:45 AM   #5
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162
Hmm. Sounds as though something so seemingly simple is actually a bit tricky.

My focus is not security. That is, I only want to confirm my configuration and plan are working as intended. I have not forced all routing through the server as a gateway, just DNS queries. My router (running DD-WRT) is still the LAN gateway.

Not that security should be ignored -- the Microsoft folks hard-code IP addresses into their systems to avoid hosts file queries. Basically any closed source software probably should be likewise untrusted. But that is beyond the scope of this little project.

I suppose there is no convenient way to confirm other than run wireshark on the client machine and then monitor in real time. Possibly another test would be to unplug the server and then monitor the client. Ideally everything would stall without a DNS server.
 
Old 12-01-2015, 02:08 AM   #6
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,748
Blog Entries: 11

Rep: Reputation: 233Reputation: 233Reputation: 233
Trust the configuration. And dont forget that all addresses resolved before unpluging could still be chached on the client.
 
Old 12-05-2015, 10:20 PM   #7
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162Reputation: 1162
I discovered another location where DNS servers are stored: Network Manager. When not using auto then be sure to edit those files as well.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
DNS queries monitoring hourly pugazhendhi_r@yahoo.com Linux - Server 2 12-31-2014 11:06 AM
Bash script that acts as a DNS proxy, except it queries several DNS servers Ulysses_ Linux - Networking 11 03-06-2014 12:31 PM
how spoof dns queries from clients and forward it to my dns server ? dr.x Linux - Server 3 10-29-2013 06:45 AM
BIND - reverse dns queries only working locally, forward dns works fine. SloS13 Linux - Networking 3 08-25-2011 12:46 PM
How to forward all DNS queries through ISP DNS server ? jcdc Linux - Networking 4 07-05-2011 11:28 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration