Difference between revisions of "Dnstop"

From OnnoWiki
Jump to navigation Jump to search
(New page: dnstop is a libpcap application (ala tcpdump) that displays various tables of DNS traffic on your network. Currently dnstop displays tables of: Source IP addresses Destination IP addresse...)
 
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
dnstop is a libpcap application (ala tcpdump) that displays various tables of DNS traffic on your network. Currently dnstop displays tables of:
+
dnstop adalah sebuah aplikasi libpcap (seperti tcpdump) yang akan menayangkan berbagai tabel dari traffic DNS di jaringan kita.
 +
Saat ini, dnstop akan menampilkan tabel:
  
−
Source IP addresses
+
Source IP addresses
−
Destination IP addresses
+
Destination IP addresses
−
Query types
+
Query types
−
Response codes
+
Response codes
−
Opcodes
+
Opcodes
−
Top level domains
+
Top level domains
−
Second level domains
+
Second level domains
−
Third level domains
+
Third level domains
−
etc...
+
dll ..
  
−
dnstop supports both IPv4 and IPv6 addresses.
+
dnstop mendukung IPv4 dan IPv6 address
  
−
To help find especially undesirable DNS queries, dnstop provides a number of filters. The filters tell dnstop to display only the following types of queries:
+
Untuk memudahkan dalam mencari DNS query yang tidak di inginkan, dnstop memberikan beberapa filter. Filter akan memerintahkan dnstop untuk menayangkan hanya tipe query berikut:
  
−
For unknown/invalid TLDs
+
For unknown/invalid TLDs
−
A queries where the query name is already an IP address
+
A queries where the query name is already an IP address
−
PTR queries for RFC1918 address space
+
PTR queries for RFC1918 address space
−
Responses with code REFUSED
+
Responses with code REFUSED
  
−
dnstop can either read packets from the live capture device, or from a tcpdump savefile.
+
dnstop dapat membaca packet dari live capture device, atau dari tcpdump savefile.
  
−
Install DNSTOP on ubuntu
+
==Install DNSTOP==
  
−
Open the terminal and run the following comamnd
+
sudo apt-get install dnstop
  
−
    sudo apt-get install dnstop
+
==DNSTOP Syntax==
  
−
DNSTOP Syntax
+
Penggunaan
  
−
    dnstop [-46apsQR] [-b expression] [-i address] [-f filter] [-r interval] [device] [savefile]
+
usage: dnstop [opts] netdevice|savefile
 +
-4 Count IPv4 packets
 +
-6 Count IPv6 packets
 +
-Q Count queries
 +
-R Count responses
 +
-a Anonymize IP Addrs
 +
-b expr BPF program code
 +
-i addr Ignore this source IP address
 +
-n name Count only messages in this domain
 +
-p Don't put interface in promiscuous mode
 +
-P Print "progress" messages in non-interactive mode
 +
-r Redraw interval, in seconds
 +
-l N Enable domain stats up to N components
 +
-X Don't tabulate the "source + query name" stats
 +
-f filter-name
 +
 +
Available filters:
 +
unknown-tlds
 +
A-for-A
 +
rfc1918-ptr
 +
refused
 +
qtype-any
  
−
Command line Options
 
  
−
The options are as follows:
+
Contoh, dengan -l 2, dnstop akan menyimpan dua tabel: satu dengan top-level domain name, dan satu lagi dengan second-level domain name.
 +
Menambahkan level akan memberikan data yang lebih detail, tapi juga membutuhkan memory & CPU.
  
−
-4 -- count only messages with IPv4 addresses
+
==Contoh==
−
-6 -- count only messages with IPv6 addresses
 
−
-Q -- count only DNS query messages
 
−
-R -- count only DNS reply messages
 
−
-a -- anonymize addresses
 
−
-b expression -- BPF filter expression default: udp port 53)
 
−
-i address -- ignore select addresses
 
−
-p -- Do not put the interface into promiscuous mode.
 
−
-r -- Redraw interval (seconds).
 
−
-l level -- keep counts on names up to level domain name levels.
 
  
−
For example, with -l 2 (the default), dnstop will keep two tables: one with top-level domain names, and another with second-level domain names. Increasing the level provides more details,but also requires more memory and CPU.
+
dnstop eth0
  
−
-f -- input filter name
+
Contoh hasil
−
 
 
−
The "unknown-tlds" filter includes only queries for TLDs that are bogus.Useful for identifying hosts/servers that leak queries for things like "localhost" or "workgroup."
 
−
 
 
−
The "A-for-A" filter includes only A queries for names that are already IP addresses. Certain Microsoft Windows DNS servers have a known bug that forward these queries.
 
−
 
 
−
The "rfc1918-ptr" filter includes only PTR queries for addresses in RFC1918 space. These should never leak from inside an organi-zation.
 
−
 
 
−
The "refused" filter, when used with the -R option, tells dnstop to count only replies with rcode REFUSED.
 
−
 
 
−
The "qtype-any" filter tells dnstop to count only message of type ANY.
 
−
 
 
−
-n name -- Only count messages within the domain name
 
−
 
 
−
-P -- Print "progress" messages on stderr when in non-interactive mode.
 
−
 
 
−
-B buckets -- Use buckets hash table buckets.
 
−
 
 
−
-X -- Do not tabulate the sources + query name counters. This can significantly reduce memory usage on busy servers and large save files.
 
−
 
 
−
savefile -- a captured network trace in pcap format
 
−
 
 
−
device -- ethernet device (ie fxp0)
 
−
 
 
−
Example
 
−
 
 
−
    dnstop eth0
 
  
  
 +
Queries: 0 new, 179 total                                                                                              Wed Jun 24 12:47:25 2015
 +
 +
Sources          Count      %  cum%
 +
------------- --------- ------ ------
 +
192.168.10.11      179  100.0  100.0
  
 
==Referensi==
 
==Referensi==
  
 
* http://www.ubuntugeek.com/dnstop-stay-on-top-of-your-dns-traffic.html
 
* http://www.ubuntugeek.com/dnstop-stay-on-top-of-your-dns-traffic.html

Latest revision as of 12:54, 24 June 2015

dnstop adalah sebuah aplikasi libpcap (seperti tcpdump) yang akan menayangkan berbagai tabel dari traffic DNS di jaringan kita. Saat ini, dnstop akan menampilkan tabel: 

Source IP addresses
Destination IP addresses
Query types
Response codes
Opcodes
Top level domains
Second level domains
Third level domains
dll ..

dnstop mendukung IPv4 dan IPv6 address

Untuk memudahkan dalam mencari DNS query yang tidak di inginkan, dnstop memberikan beberapa filter. Filter akan memerintahkan dnstop untuk menayangkan hanya tipe query berikut: 

For unknown/invalid TLDs
A queries where the query name is already an IP address
PTR queries for RFC1918 address space
Responses with code REFUSED

dnstop dapat membaca packet dari live capture device, atau dari tcpdump savefile.

Install DNSTOP

sudo apt-get install dnstop

DNSTOP Syntax

Penggunaan 

usage: dnstop [opts] netdevice|savefile
	-4	Count IPv4 packets
	-6	Count IPv6 packets
	-Q	Count queries
	-R	Count responses
	-a	Anonymize IP Addrs
	-b expr	BPF program code
	-i addr	Ignore this source IP address
	-n name	Count only messages in this domain
	-p	Don't put interface in promiscuous mode
	-P	Print "progress" messages in non-interactive mode
	-r	Redraw interval, in seconds
	-l N	Enable domain stats up to N components
	-X	Don't tabulate the "source + query name" stats
	-f	filter-name

Available filters:
	unknown-tlds
	A-for-A
	rfc1918-ptr
	refused
	qtype-any


Contoh, dengan -l 2, dnstop akan menyimpan dua tabel: satu dengan top-level domain name, dan satu lagi dengan second-level domain name. Menambahkan level akan memberikan data yang lebih detail, tapi juga membutuhkan memory & CPU.

Contoh

dnstop eth0

Contoh hasil 


Queries: 0 new, 179 total                                                                                              Wed Jun 24 12:47:25 2015

Sources           Count      %   cum%
------------- --------- ------ ------
192.168.10.11       179  100.0  100.0

Referensi

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=Dnstop&oldid=43643"