DNS Tracking with BIND
Revision as of 11:08, 7 September 2022 by Root (talk | contribs) (Created page with "If you want to "spy" on a program and see if it is "calling home", it can be done with BIND / NAMED. Remember, BIND / NAMED keeps its lookup cache in RAM, so it needs to be dumped into a file to read (IE, it's a multi-step process) === Set BIND / NAMED Up === Add the following in the Options section of /etc/bind/named.conf (or whatever directory the configuration file is in) * dump-file "/var/cache/bind/named_dump.db"; (That's usually the default path, wit...")
If you want to "spy" on a program and see if it is "calling home", it can be done with BIND / NAMED. Remember, BIND / NAMED keeps its lookup cache in RAM, so it needs to be dumped into a file to read (IE, it's a multi-step process)
Set BIND / NAMED Up
Add the following in the Options section of /etc/bind/named.conf (or whatever directory the configuration file is in)
- dump-file "/var/cache/bind/named_dump.db"; (That's usually the default path, with any file name desired)
Command for Viewing File
rndc dump -cache (older version used a 'double dash': rndc dump --cache)
Find the String You're Looking for
grep "WhatEverStringYou'reSeachingFor" /tmp/cache/bind/named_dump.db