I am getting lots of these this IPS rule alerts:
[HTML]Message........: INDICATOR-COMPROMISE Suspicious .pw dns query
Details........: www.snort.org/.../28039
Time...........: 2014-03-31 09:24:21
Packet dropped.: yes
Priority.......: high
Classification.: A Network Trojan was detected IP protocol....: 17 (UDP)
Source IP address: 10.10.10.100
- www.dnsstuff.com/.../ptr.ch
- www.ripe.net/.../whois
- ws.arin.net/.../whois.pl
- cgi.apnic.net/.../whois.pl
Source port: 53358
Destination IP address: 10.10.10.1 (utm)
- www.dnsstuff.com/.../ptr.ch
- www.ripe.net/.../whois
- ws.arin.net/.../whois.pl
- cgi.apnic.net/.../whois.pl
Destination port: 53 (domain)
[/HTML]
We are running the UTM as a DNS proxy for all internal networks with OPENDNS servers as the forwarders.
I want to see what domains the internal clients are querying but it appears that the DNSproxy log is not logging this data.
What is the best way to capture the DNS FQDN queries of the internal network clients?
This thread was automatically locked due to age.
