This App visualizes DNS traffic and helps to pinpoint errors and anomalies like DNS-Tunneling
This App takes an output of tcpdump as input, parses it and displays results as the following charts and tables:
Total Events
Parsing Errors
Query Type Distribution
Return Code Distribution
Protocol (UDP/TCP) Distribution
Top Queries
Top Level Domains
Top Reverse Resolution Entries (PTR)
Top DNS Errors
Slowest Transactions
Top Destinations
Top Sources
Packet count vs number of query names
DNS Packet Length
Number of Labels in the dns_qry_name
Query duration
Possible DNS Tunnelling
The DNS Traffic can be collected simultaneously from many different devices:
-windows (using TA-tshark or by capturing with Wireshark/tshark/dumpcap, and parsing with tcpdump on linux)
-linux (using TA-tcpdump or TA-tshark)
-switch mirror port (SPAN)
-TAP device
-manual import from a saved network dump (pcap file)
-Splunk Stream (https://splunkbase.splunk.com/app/1809/)
-Technology Add-On for Unbound DNS (https://splunkbase.splunk.com/app/4888/)
-Splunk Add-on for ISC BIND (https://splunkbase.splunk.com/app/2876/) - query log only
For a single deployment (to collect DNS traffic from one system only) you need to install Splunk Enterprise + DNS_Insight App + TA-tcpdump (Linux) or TA-tshark (Windows).
For a distributed deploymeint (to collect DNS traffic from many systems):
Windows: Splunk Universal Forwarder + TA-tshark
Linux: Splunk Universal Forwarder + TA-tcpdump
Indexer: Splunk Enterprise + DNS_Insight App + TA-tshark + TA-tcpdump
Search Head: Splunk Enterprise + DNS_Insight App + TA-tshark + TA-tcpdump
Here is an example of a complete setup using a CentOS 7 or Debian 10 as a source of a DNS data input:
ATTENTION: running tcpdump as suggested can be a security risk and an example is provided for informational purposes only! Consult a security expert to minimize risk if unsure!
Option 1 - using TA-tcpdump (prefered, more secure and real time):
Download and install a preconfigured TA-tcpdump Addon from https://splunkbase.splunk.com/app/4818/
Option 2 - parsing after pcap rotation
Check if there is enough free space on the hard drive. You can consider using a separate partition for the tcpdump data.
aa-complain /usr/sbin/tcpdump # set tcpdump to complain mode - debian only
useradd -d /nonexistent -s /usr/sbin/nologin tcpdup # add a restricted tcpdump user
mkdir var/tcpdump # create a folder where pcap files and a script are stored
chown :tcpdump /var/tcpdump # change ownership of the directory
chmod g+w,o-w /var/tcpdump # change permissions of the directory
create /var/tcpdump/pcap2txt.sh file with this content:
#!/bin/bash
set -euo pipefail
IFS=$'\n\t'
INFILE=$1
OUTFILE=/var/tcpdump/tcpdump.txt
LOG=/var/tcpdump/out.log
date >> $LOG
/usr/sbin/tcpdump -tttt -nns0 port 53 -r $INFILE > $OUTFILE 2>> $LOG
wc $OUTFILE >> $LOG
add an executable bit:
chmod +x /var/tcpdump/pcap2txt.sh
This script will create a text dump from the recorded data after the rotation which can be sent to the splunk indexer using rsyslog/syslog-ng or splunk-forwarder. This input should be configured as a "port53tttt" sourcetype on the splunk indexer.
now start tcpdump (change the interface name as needed):
nohup tcpdump -pnns0 port 53 [-i ens32] -w /var/tcpdump/tcpdump.pcap -W100 -C100 -z /var/tcpdump/pcap2txt.sh -Z tcpdump &>>/var/tcpdump/out.log &
where:
-pnns0 - no promiscuous mode, don't convert protocol and port numbers etc. to names
-C100 -W100 - create a ring buffer of 100 files a 100MB (10GB in total)
-w - where to store recorded data
-z /var/tcpdump/pcap2txt.sh - run a simple script after rotation
-Z tcpdump - run as restricted "tcpdump" user
This app tested with CentOS 6/7, Debian 9/10 and Splunk 6/7/8.
Q: Some panels, like "Total events", show wrong number of events, something between 500.000 and 550.000, even if there are much more events available.
A: Most panels utilize base_search, that has a default limit of 500.000 results. To overcome this limitation, increase [search] max_count in local/limits.conf or rewrite searches to remove base_search from the query.
Contact: splunk@compek.net
Saved Search renamed from "search" to DNS_insight_search to avoid name clash. Supported sourcetypes are called now tshark:port53 and tcpdump:port53. A macro named DNS_insight_index_and_sourcetype is used to define all used sourcetypes and indexes.
added "source" input to facilitate ad-hoc search, added sc_admin role to default.meta
applied required changes to keep compatibility with Splunk Cloud (use jquery 3.5)
-minor fixes and cleanups
-better description
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.