1DNSTOP(8) BSD System Manager's Manual DNSTOP(8)
2
4 dnstop — displays various tables of DNS traffic on your network
5
7 dnstop [-46apsQR] [-b expression] [-i address] [-f filter] [-r interval]
8 [device] [savefile]
9
11 dnstop is a small tool to listen on device or to parse the file savefile
12 and collect and print statistics on the local network's DNS traffic. You
13 must have read access to /dev/bpf*.
14
16 The options are as follows:
17 -4 count only messages with IPv4 addresses
19 -6 count only messages with IPv6 addresses
21 -Q count only DNS query messages
23 -R count only DNS reply messages
25 -a anonymize addresses
27 -b expression
29 BPF filter expression
30 (default: udp port 53)
31 -i address
33 ignore select addresses
34 -p Do not put the interface into promiscuous mode.
36 -r Redraw interval (seconds).
38 -l level
40 keep counts on names up to level domain name levels.
41 For example, with -l 2 (the default), dnstop will keep two ta‐
43 bles: one with top-level domain names, and another with second-
44 level domain names. Increasing the level provides more details,
45 but also requires more memory and CPU.
46 -f input filter name
48 The "unknown-tlds" filter includes only queries for TLDs that are
50 bogus. Useful for identifying hosts/servers that leak queries
51 for things like "localhost" or "workgroup."
52 The "new-gtlds" filter includes only queries for the new gTLD
54 program of 2013/2014. Useful for identifying hosts/servers that
55 use names which may result in future collisions and problems when
56 new gTLDs become active.
57 The "A-for-A" filter includes only A queries for names that are
59 already IP addresses. Certain Microsoft Windows DNS servers have
60 a known bug that forward these queries.
61 The "rfc1918-ptr" filter includes only PTR queries for addresses
63 in RFC1918 space. These should never leak from inside an organi‐
64 zation.
65 The "refused" filter, when used with the -R option, tells dnstop
67 to count only replies with rcode REFUSED.
68 The "servfail" filter, when used with the -R option, tells dnstop
70 to count only replies with rcode SERVFAIL.
71 The "qtype-any" filter tells dnstop to count only message of type
73 ANY.
74 -n name
76 Only count messages within the domain name
77 -P Print "progress" messages on stderr when in non-interactive mode.
79 -B buckets
81 Use buckets hash table buckets.
82 -X Do not tabulate the sources + query name counters. This can sig‐
84 nificantly reduce memory usage on busy servers and large save‐
85 files.
86 savefile
88 a captured network trace in pcap format
89 device ethernet device (ie fxp0)
91
93 While running, the following options are available to alter the display:
94 s display the source address table
96 d display the destination address table
98 t display the breakdown of query types seen
100 r display the breakdown of response codes seen
102 o display the breakdown of opcodes seen
104 1 show 1st level query names
106 2 show 2nd level query names
108 3 show 3rd level query names
110 4 show 4th level query names
112 5 show 5th level query names
114 6 show 6th level query names
116 7 show 7th level query names
118 8 show 8th level query names
120 9 show 9th level query names
122 ! show sources + 1st level query names
124 @ show sources + 2nd level query names
126 # show sources + 3rd level query names
128 $ show sources + 4th level query names
130 % show sources + 5th level query names
132 ^ show sources + 6th level query names
134 & show sources + 7th level query names
136 * show sources + 8th level query names
138 ( show sources + 9th level query names
140 ^R reset the counters
142 ^X exit the program
144 space redraw
146 ? help
148
150 If stdout is not a tty, dnstop runs in non-interactive mode. In this
151 case, you must supply a savefile for reading, instead of capturing live
152 packets. After reading the entire savefile, dnstop prints the top 50 en‐
153 tries for each table.
154
156 By default dnstop examines only query messages and ignores replies. In
157 this case the response code table is meaningless and will likely show
158 100% "Noerror."
159 If you supply (only) the -R command line option, dnstop examines replies
161 and ignores queries. This allows you to see meaningful response code
162 values, as well as all the other tables. In this case all the query at‐
163 tributes (such as type and name) are taken from the Question section of
164 the reply.
165 Note, however, that it is common for a stream of DNS messages to contain
167 more queries than replies. This could happen, for example, if the server
168 is too busy to respond to every single query, or if the server is de‐
169 signed to ignore malformed query messages. Therefore, you might want to
170 examine both queries and replies by giving both -R and -Q command line
171 options. In this case, only the response code counts are taken from the
172 replies and all other attributes are taken from the queries.
173
175 Duane Wessels (wessels@measurement-factory.com)
176 Mark Foster (mark@foster.cc)
177 Jose Nazario (jose@monkey.org)
178 Sam Norris <@ChangeIP.com>
179 Max Horn <@quendi.de>
180 John Morrissey <jwm@horde.net>
181 Florian Forster <octo@verplant.org>
182 Dave Plonka <plonka@cs.wisc.edu>
183 http://dnstop.measurement-factory.com/
184
186 Does not support TCP at this time.
187BSD 21 March, 2008 BSD