who is talking to my ms dns server?
turn on debug logging on the server. we want incoming client requests.
your logs will be here: c:\Windows\System32\dns\
since we're doing our work on a linux box...
$ sudo mount -t cifs -o username=myname,password=mypass\!,domain=hell.hades.com //thedamned/C$ /tmp/amount/
copy the log.
$ cp /tmp/amount/Windows/System32/dns/dns.log ~
remove everything except for the ip addresses. sort the results and
remove all duplicate entries. write to file for further processing.
$ cat dns.log | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort -nu >> pithyresolv
ip addresses are fine? since names are even more useful,
create the following bash script, getresolv.sh:
#!/bin/bash
while read line
do
dig -x "$line" +short >> resolved
done
feed the list into the script:
$ ./getresolv.sh < pithyresolv
$ cat resolved | mailx me@hell
there. sliced, diced, and emailed.
Monday, August 21, 2017
who is talking to my microsoft windows dns server?
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment