Monday, August 21, 2017

who is talking to my microsoft windows dns server?

 who is talking to my ms dns server?  
   
 turn on debug logging on the server. we want incoming client requests.  
 your logs will be here: c:\Windows\System32\dns\   
   
 since we're doing our work on a linux box...  
   
 $ sudo mount -t cifs -o username=myname,password=mypass\!,domain=hell.hades.com //thedamned/C$ /tmp/amount/  
   
 copy the log.  
   
 $ cp /tmp/amount/Windows/System32/dns/dns.log ~  
   
 remove everything except for the ip addresses. sort the results and   
 remove all duplicate entries. write to file for further processing.  
   
 $ cat dns.log | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort -nu >> pithyresolv  
   
 ip addresses are fine? since names are even more useful,  
 create the following bash script, getresolv.sh:  
   
   
 #!/bin/bash  
   
 while read line  
 do  
   dig -x "$line" +short >> resolved  
 done  
   
   
 feed the list into the script:  
   
 $ ./getresolv.sh < pithyresolv  
 $ cat resolved | mailx me@hell  
   
 there. sliced, diced, and emailed.  
   
   

No comments: