1DNSTOP(8) BSD System Manager's Manual DNSTOP(8)
2
4 dnstop — displays various tables of DNS traffic on your network
5
7 dnstop [-46apsQR] [-b expression] [-i address] [-f filter] [-r interval]
8 [device] [savefile]
9
11 dnstop is a small tool to listen on device or to parse the file savefile
12 and collect and print statistics on the local network's DNS traffic. You
13 must have read access to /dev/bpf*.
14
16 The options are as follows:
17 -4 count only messages with IPv4 addresses
19 -6 count only messages with IPv6 addresses
21 -Q count only DNS query messages
23 -R count only DNS reply messages
25 -a anonymize addresses
27 -b expression
29 BPF filter expression
30 (default: udp port 53)
31 -i address
33 ignore select addresses
34 -p Do not put the interface into promiscuous mode.
36 -r Redraw interval (seconds).
38 -l level
40 keep counts on names up to level domain name levels.
41 For example, with -l 2 (the default), dnstop will keep two
43 tables: one with top-level domain names, and another with second-
44 level domain names. Increasing the level provides more details,
45 but also requires more memory and CPU.
46 -f input filter name
48 The "unknown-tlds" filter includes only queries for TLDs that are
50 bogus. Useful for identifying hosts/servers that leak queries
51 for things like "localhost" or "workgroup."
52 The "new-gtlds" filter includes only queries for the new gTLD
54 program of 2013/2014. Useful for identifying hosts/servers that
55 use names which may result in future collisions and problems when
56 new gTLDs become active.
57 The "A-for-A" filter includes only A queries for names that are
59 already IP addresses. Certain Microsoft Windows DNS servers have
60 a known bug that forward these queries.
61 The "rfc1918-ptr" filter includes only PTR queries for addresses
63 in RFC1918 space. These should never leak from inside an organi‐
64 zation.
65 The "refused" filter, when used with the -R option, tells dnstop
67 to count only replies with rcode REFUSED.
68 The "qtype-any" filter tells dnstop to count only message of type
70 ANY.
71 -n name
73 Only count messages within the domain name
74 -P Print "progress" messages on stderr when in non-interactive mode.
76 -B buckets
78 Use buckets hash table buckets.
79 -X Do not tabulate the sources + query name counters. This can sig‐
81 nificantly reduce memory usage on busy servers and large save‐
82 files.
83 savefile
85 a captured network trace in pcap format
86 device ethernet device (ie fxp0)
88
90 While running, the following options are available to alter the display:
91 s display the source address table
93 d display the destination address table
95 t display the breakdown of query types seen
97 r display the breakdown of response codes seen
99 o display the breakdown of opcodes seen
101 1 show 1st level query names
103 2 show 2nd level query names
105 3 show 3rd level query names
107 4 show 4th level query names
109 5 show 5th level query names
111 6 show 6th level query names
113 7 show 7th level query names
115 8 show 8th level query names
117 9 show 9th level query names
119 ! show sources + 1st level query names
121 @ show sources + 2nd level query names
123 # show sources + 3rd level query names
125 $ show sources + 4th level query names
127 % show sources + 5th level query names
129 ^ show sources + 6th level query names
131 & show sources + 7th level query names
133 * show sources + 8th level query names
135 ( show sources + 9th level query names
137 ^R reset the counters
139 ^X exit the program
141 space redraw
143 ? help
145
147 If stdout is not a tty, dnstop runs in non-interactive mode. In this
148 case, you must supply a savefile for reading, instead of capturing live
149 packets. After reading the entire savefile, dnstop prints the top 50
150 entries for each table.
151
153 By default dnstop examines only query messages and ignores replies. In
154 this case the response code table is meaningless and will likely show
155 100% "Noerror."
156 If you supply (only) the -R command line option, dnstop examines replies
158 and ignores queries. This allows you to see meaningful response code
159 values, as well as all the other tables. In this case all the query
160 attributes (such as type and name) are taken from the Question section of
161 the reply.
162 Note, however, that it is common for a stream of DNS messages to contain
164 more queries than replies. This could happen, for example, if the server
165 is too busy to respond to every single query, or if the server is
166 designed to ignore malformed query messages. Therefore, you might want
167 to examine both queries and replies by giving both -R and -Q command line
168 options. In this case, only the response code counts are taken from the
169 replies and all other attributes are taken from the queries.
170
172 Duane Wessels (wessels@measurement-factory.com)
173 Mark Foster (mark@foster.cc)
174 Jose Nazario (jose@monkey.org)
175 Sam Norris <@ChangeIP.com>
176 Max Horn <@quendi.de>
177 John Morrissey <jwm@horde.net>
178 Florian Forster <octo@verplant.org>
179 Dave Plonka <plonka@cs.wisc.edu>
180 http://dnstop.measurement-factory.com/
181
183 Does not support TCP at this time.
184BSD 21 March, 2008 BSD