How can I determine which specific process/service on my CentOS box is generating excessive DNS queries?

Question

CentOS 5.x

One of my CentOS servers is generating an excessive amount of DNS queries (as noted by my DNS admin). Unfortunately it's unclear from service logs which process on my server is responsible for this.

I originally thought I could just look at the queries themselves for clues, but they are reverse DNS queries for popular IPs -- so I can't easily identify the origin of the query based on the search criteria.

Is there a command or method I can use to determine which process/service is issuing the queries?

@Ward would Wireshark show what process owned it? I already know what the queries themselves are. — Mike B, Apr 21 '16 at 05:03

score 1 · Answer 1 · answered Apr 20 '16 at 19:10

1

Use iptables to help you narrow it down, by logging the user ID of outgoing DNS queries.

iptables -I OUTPUT -m tcp -p tcp --dport 53 -m state --state NEW -j LOG --log-prefix "DNS traffic: " --log-uid
iptables -I OUTPUT -m udp -p udp --dport 53 -m state --state NEW -j LOG --log-prefix "DNS traffic: " --log-uid

This is the best you can do with iptables, but knowing the uid originating the traffic may be helpful in narrowing down its source.

answered Apr 20 '16 at 19:10

Michael Hampton

244,070
43
506
972

Pardon my ignorance but where exactly is that logged? – Mike B Apr 21 '16 at 05:01
1

In the system log. – Michael Hampton Apr 21 '16 at 05:15
When I'm finished logging, is there an easy way to turn off the logging without breaking dns queries? How would I restore the non-logging state? – Mike B May 06 '16 at 23:00
You could just delete those rules. – Michael Hampton May 07 '16 at 01:34

score 0 · Answer 2 · answered Aug 10 '22 at 07:49

0

iptables -I OUTPUT -p UDP --dport 53 -m string --algo bm --string foobar.su -j LOG --log-uid --log-prefix FOOBAR_MATCH

journalctl -t kernel -f | perl -ne '/FOOBAR_MATCH/ && /SPT=(\d+)/ && system("lsof -i udp:$1")'

answered Aug 10 '22 at 07:49

wcc526

231
2
4

How can I determine which specific process/service on my CentOS box is generating excessive DNS queries?

2 Answers2