How to gather DNS A record requests?

Question

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump:

tcpdumpdns=OUTPUT-FILENAME-HERE
nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 &

It makes an output file like:

19:26:12.185392 IP 172.16.0.6.57977 > google-public-dns-a.google.com.domain: 51198+ A? yahoo.com. (27)

So I need to process that to get the yahoo.com:

echo $tcpdumpdns | awk '/ A\? / {u = NF - 1; print $u}' | sed 's/^www.//g; s/.$//g' | sort -u

Is there any better solution to gather all the outgoing A record requests?

p.s.: collecting DNS A records is only needed to have an up-to-date list of websites that are reachable via HTTPS. So I can generate xml files for HTTPSEverywhere Firefox Add-on. So this is just a part of a script.

do you have a GUI env, if so using wireshark-gtk is an easier solution, since you can filter there much easily. — Hanan, Dec 20 '11 at 19:29
@Hanan N.: GUI is not an option. this is needed to be automatic. — LanceBaynes, Dec 20 '11 at 19:34
@Michael Mrozek: I hope nothing. But I asked because I'm open for alternative solutions. — LanceBaynes, Dec 20 '11 at 19:34

score 17 · Answer 1 · edited Jun 19 '13 at 12:47

17

If you don't have wireshark installed then

tcpdumpdns=/tmp/tcpdumps
tcpdump -lvi any "udp port 53" | tee $tcpdumpdns

should work for you. As you wanted to limit the output to the second to last value then I would parse your log file with:

grep -E 'A\?' $tcpdumpdns |sed -e 's/^.*A? //' -e 's/ .*//'|sort -u

If you want it live then:

tcpdump -lvi any "udp port 53" 2>/dev/null|grep -E 'A\?'|awk '{print $(NF-1)}'

should do it, (here sed and awk are interchangeable; and I would pick awk.)

edited Jun 19 '13 at 12:47

Anthon

79,293

answered Jun 19 '13 at 12:29

Alexx Roche

320

grep -E 'A\?' $tcpdumpdns |sed 's/^.*A? //;s/ .*//'|sort -u is less to type – Alexx Roche Jan 16 '19 at 13:17

u1686_grawity · Accepted Answer · 2015-06-21T08:59:46.413

14

Use Wireshark:

tshark -f "udp port 53" -Y "dns.qry.type == A and dns.flags.response == 0"

edited Jun 21 '15 at 08:59

answered Dec 21 '11 at 08:41

u1686_grawity

5,858

4

I get tshark: "A" cannot be found among the possible values for dns.qry.type. – Jack O'Connor Feb 07 '17 at 18:49
5

To address @JackO'Connor issue, the decimal value for a type A DNS record is 1. Therefore, this should work: tshark -f "udp port 53" -Y "dns.qry.type == 1 and dns.flags.response == 0" – Rolinh Mar 14 '17 at 08:54

How to gather DNS A record requests?

2 Answers2