reverse DNS based on bro's forward DNS query log

Zeek
1

Hiya,

while I'm at sharing bro related stuff, I've got a setup here
that parses bro's DNS log in real time and updates the database
of a local DNS server (powerdns with mysql backend) so as to
provide with more useful PTR records.

$ tail -1 dns.log
1345732627.030897 jUJU3ZwGOv4 x.x.x.x 54866 x.x.x.x 53 udp 44687 static.ak.facebook.com 1 C_INTERNET 1 A 0 NOERROR F F
        F T T 0 static.ak.facebook.com.edgesuite.net,a749.dsw4.akamai.net,84.53.132.80,84.53.132.88 3364.000000,348.000000,15.000000,15.000000

$ dig -x 84.53.132.88 +short
static.ak.facebook.com.C-EU.120823T143707.

For many "cloud" IP addresses, it won't necessarily be useful,
but in many case, it gives more useful information than the
real PTR record.

Above, it tells us that 84.53.132.88 was last the result of a
query for an A record for static.ak.facebook.com (at 14:37:07),
and it gives you the result of the geoiplookup.

It can be generalised for other things (like for internal IP
addresses, I use other sources of information to feed the
powerdns database).

If anybody is interested, I can post the intructions on how to
set it up along with the small perl script that parses the bro
dns logs here or on github.

2

That's cool! Definitely send along anything you can. I'm sure that quite a few people will be interested in this (I am).

In 2.2 we should have some database logging framework writer plugins so we might be able to remove your script eventually and have Bro send these logs directly to the database.

Yet another cool Bro thing! You're on a roll today.

FYI, the mailing list address is bro@bro-ids.org now. The old lbl.gov address was deprecated a while ago.

.Seth

3

2012-08-23 11:15:23 -0400, Seth Hall:

> tail \-1 dns\.log > 1345732627\.030897 jUJU3ZwGOv4 x\.x\.x\.x 54866 x\.x\.x\.x 53 udp 44687 static\.ak\.facebook\.com 1 C\_INTERNET 1 A 0 NOERROR F F > F T T 0 static\.ak\.facebook\.com\.edgesuite\.net,a749\.dsw4\.akamai\.net,84\.53\.132\.80,84\.53\.132\.88 3364\.000000,348\.000000,15\.000000,15\.000000 > > dig -x 84.53.132.88 +short
> static.ak.facebook.com.C-EU.120823T143707.

That's cool! Definitely send along anything you can. I'm sure that quite a few people will be interested in this (I am).

[...]

Here you go:

please test and tell me what you think.