Home / server / Questions / 81145
Accepted
Tedd Johnson
Asked: 2009-11-04 12:28:42 +0800 CST

Capture All DNS Traffic

  • 772

I have a system that receives many different DNS requests every day from unauthorized users. What I need is a method to accept all DNS requests made to to this system and give back them back the same IP. Think of this as a gateway situation, where regardless of their DNS request, it will hand back the same IP.

Is it possible to do this through BIND? or is there a better more elegant solution?

domain-name-system

4 Answers

  1. Best Answer

    My evldns framework could do this trivially and with the minimum of memory overhead, if you've got a Linux box available.

    A plugin that always gives out a specific IP would only take a dozen or so lines of code.

    If you can wait a day or so I might even write it myself...

    EDIT - I've now done this - if you look at the mod_arec.c and fixed.c modules there's a demo of how to always return a specific IP address for any inbound IN A foo query.

    • 2

  2. I'd just use iptables to redirect all port 53 traffic to wherever it needs to go.

    • 0

  3. The best answer, in my opinion, is going to be to whip one up in the programming language of your choice. It's easy enough to do in python using twisted.names.

    • 0

  4. It's called a wildcard DNS record, and yes, it's doable with Bind and possibly other servers too.

    Google it, or at least see this Wikipedia page. It's pretty trivial after all.

    • 0