gamelinux / passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup
http://gamelinux.org/
1.67k stars 372 forks source link

Add support for DNS request (only) logging #30

Closed bweymes closed 9 years ago

bweymes commented 11 years ago

From using passivedns, I can see that if there is only requests, it wouldn't log anything. I would really like to see it log them. Adding a flag for query logging would be nice: ./passivendns -q /var/log/passivedns-failed-query.log

I hope the existing setup of caching the request and responses could be extended to allow for requests to be logged only when there is no response seen. A small timeout would suffice I think. Let me be clear: DNS requests that have not gotten answers is what I am interested in logging.

This is an important feature I believe is missing. I can also imagine it being very useful for DNS debugging.

gamelinux commented 11 years ago

Can you please try out the branch "clientquery". From my limited testing, this should log the queries if there is no valid DNS response from the server. ATM. it is turned on at all time, logging default to /var/log/passivedns-query.log

Feedback would be great.

E

bweymes commented 11 years ago

Hello Edward,

Oh this will be tested for sure in the next few hours/days. Ill get back to you on the results...

Cheers Barrry

On Thu, Apr 18, 2013 at 3:07 PM, Edward Fjellskål notifications@github.comwrote:

Can you please try out the branch "clientquery". From my limited testing, this should log the queries if there is no valid DNS response from the server. ATM. it is turned on at all time, logging default to /var/log/passivedns-query.log

Feedback would be great.

E

— Reply to this email directly or view it on GitHubhttps://github.com/gamelinux/passivedns/issues/30#issuecomment-16575218 .

maxtors commented 10 years ago

Has this been tested as stated by bweymes? Or just another forgotten github comment? =)

thus commented 9 years ago

He probably forgot or didn't bother to report back with the results. Closing the issue, since it's over a year old.