dnsmasq
1. Lire et analyser les logs
Consulter les logs des actions du service dnsmasq :
Jun 10 17:50:00 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:00 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:21 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:21 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:31 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:31 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:37 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:37 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:40 dnsmasq[21796]: query[A] zyx.qq.com from 115.34.22.160 Jun 10 17:50:40 dnsmasq[21796]: forwarded zyx.qq.com to 114.114.114.114 Jun 10 17:50:40 dnsmasq[21796]: forwarded zyx.qq.com to 223.5.5.5 Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 123.151.43.51 Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 183.60.62.158 Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 113.108.1.90 Jun 10 17:50:42 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:42 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:52 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160 Jun 10 17:50:52 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4 Jun 10 17:50:58 dnsmasq[21796]: query[A] ic.wps.cn from 115.34.22.160
Extraire une liste des noms de domaine demandés :
awk '!seen[$6]++ {print $6}' /var/log/syslog
Discussion