# duplicated intel logs DNS::IN\_REQUEST **URL:** \ **Category:** Zeek\ **Created:** [October 3, 2019, 12:35pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853 "2019-10-03T12:35:23Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\ **Post date:** [October 3, 2019, 12:35pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/1 "2019-10-03T12:35:23Z")
Hi everybody, I am having an issue with the intel.log file, I am getting duplicated lines for the same dns request such as: #fields ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p seen.indicator seen.indicator\_type seen.where seen.node matched sources fuid file\_mime\_type file\_desc cif.tags cif.confidence cif.source cif.description cif.firstseen cif.lastseen #types time string addr port addr port string enum enum string set[enum] set[string] string string string string double string string string string 1570105259.197420 CP1BZx1QgzdPpfEyda 172.17.0.186 43283 172.16.1.10 53 [opencalphad.com](http://opencalphad.com) Intel::DOMAIN DNS::IN\_REQUEST worker-1 Intel::DOMAIN 0 - - - - 85.0 - - - - 1570105259.197420 CP1BZx1QgzdPpfEyda 172.17.0.186 43283 172.16.1.10 53 [opencalphad.com](http://opencalphad.com) Intel::DOMAIN DNS::IN\_REQUEST worker-1 Intel::DOMAIN 0 - - - - 85.0 - - - - 1570105259.207335 CJZASAQTB2qgPSYw7 172.17.0.186 59553 172.16.1.10 53 [opencalphad.com](http://opencalphad.com) Intel::DOMAIN DNS::IN\_REQUEST worker-1 Intel::DOMAIN 0 - - - - 85.0 - - - - 1570105259.211927 CJZASAQTB2qgPSYw7 172.17.0.186 59553 172.16.1.10 53 [opencalphad.com](http://opencalphad.com) Intel::DOMAIN DNS::IN\_REQUEST worker-1 Intel::DOMAIN 0 - - - - 85.0 - - As you can see, some lines are identical, same uid, same worker, same timestamp, etc… I have the same issue on different machines and I tried both bro v.2.6.1 and latest zeek from github. Does anyone have a clue about what is happening? Thanks, Mauro ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [October 3, 2019, 1:21pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/2 "2019-10-03T13:21:26Z")
Would it be possible to grab a pcap that recreates this behavior? Certainly not the correct behavior and it sounds like you've thought through the potential issues pretty thoroughly already and I agree with your thoughts. We might be at the point of just needing the PCAP to see what's causing it.    .Seth ---
**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\ **Post date:** [October 3, 2019, 2:14pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/3 "2019-10-03T14:14:06Z")
It turned out that there is an issue in our network and we are in fact getting duplicated dns packets on the span port... So bro sees only one dns session in dns.log (and only one uid in conn.log), but the event dns\_request is raised more than once and hence we get multiple intel matches. Thanks and sorry for the false alarm... Mauro -----Messaggio originale----- ---
**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\ **Post date:** [October 3, 2019, 3:58pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/4 "2019-10-03T15:58:00Z")
The usual case for this is that you are tapping the same traffic twice. If you look up the CP1BZx1QgzdPpfEyda connection in the conn.log and look at orig\_pkts and resp\_pkts you should see 1 and 1. If you see 2,2 or 2,1 then you are seeing duplicate packets. justin@mbp:/tmp/b$ cat dns.log |bro-cut uid qtype\_name query Cu1Xq04w0nXaBiFiD A [opencalphad.com](http://opencalphad.com) CJYuzY33KkZubxHXMc AAAA [opencalphad.com](http://opencalphad.com) CdgXOb43ML2PJSv84a MX [opencalphad.com](http://opencalphad.com) justin@mbp:/tmp/b$ cat conn.log |bro-cut uid orig\_pkts resp\_pkts |fgrep Cu1Xq04w0nXaBiFiD Cu1Xq04w0nXaBiFiD 1 1 ---
**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\ **Post date:** [October 4, 2019, 8:08am UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/5 "2019-10-04T08:08:19Z")
Hi Justin, I am in fact seeing 2,2 or 2,0 as orig\_pkts and resp\_pkts. And I confirmed this with tcpdump. So I believe it is an issue with the network we are tapping as I see these duplicated packets only for dns. Thnaks Mauro **Inviato:** giovedì 3 ottobre 2019 17:58 ---
**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\ **Post date:** [October 4, 2019, 5:19pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/6 "2019-10-04T17:19:08Z")
Possibly, but you may have duplicates everywhere. The tcp reassembler can use the sequence numbers to avoid analyzing the same traffic twice, but UDP doesn’t have anything like that. DNS is just the place you tend to notice the duplicate traffic the most. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/duplicated-intel-logs-dns-in-request/5853/7 "2022-05-06T15:46:47Z")