search

jvns / mess-with-dns

Source for Mess With DNS
https://messwithdns.net
247 stars 19 forks source link

Show the full DNS query and response in the request log #10

Open klaus-nicat opened 2 years ago

klaus-nicat commented 2 years ago

For the incoming queries, please also log the IP address where the query comes from, not only the PTR.

Also it would be interesting to see at what IP address the request was received, mess-with-dns1.wizardzines.com. or mess-with-dns2.wizardzines.com.

mdavids commented 2 years ago

In fact, I would love to see much more info, if possible.

Like ECS (RFC7871) information, when available. As well as other EDNS0-data (the OPT-record). And also flags (like DO-bit if present).

But this may be beyond the scope of this tool. 😛

jvns commented 2 years ago

This makes sense to me, I just need to figure out the right design.

jvns commented 3 months ago

I've added the IP address, and I agree showing the full query/response is a good idea -- will look into it.

jonaslejon commented 3 months ago

I suggest looking into passive sniffing when logging the DNS-requests and responses. Using the pcap interface and something like tshark or tcpdump. I'm not a Go-programmer myself, but there seems to be GoPacket: https://github.com/google/gopacket/blob/master/layers/dns.go

jvns commented 3 months ago

@jonaslejon what problem are you proposing solving with that suggestion? We already have all the information we need to do this, displaying it is just a UI issue.