# reverse DNS based on bro's forward DNS query log **URL:** \ **Category:** Zeek\ **Created:** [August 23, 2012, 2:48pm UTC](https://community.zeek.org/t/reverse-dns-based-on-bros-forward-dns-query-log/2418 "2012-08-23T14:48:45Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Stephane\_Chazelas](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Stephane\_Chazelas](https://community.zeek.org/u/Stephane_Chazelas)\ **Post date:** [August 23, 2012, 2:48pm UTC](https://community.zeek.org/t/reverse-dns-based-on-bros-forward-dns-query-log/2418/1 "2012-08-23T14:48:45Z")
Hiya, while I'm at sharing bro related stuff, I've got a setup here that parses bro's DNS log in real time and updates the database of a local DNS server (powerdns with mysql backend) so as to provide with more useful PTR records. $ tail -1 dns.log 1345732627.030897 jUJU3ZwGOv4 x.x.x.x 54866 x.x.x.x 53 udp 44687 [static.ak.facebook.com](http://static.ak.facebook.com) 1 C\_INTERNET 1 A 0 NOERROR F F         F T T 0 [static.ak.facebook.com.edgesuite.net](http://static.ak.facebook.com.edgesuite.net),[a749.dsw4.akamai.net](http://a749.dsw4.akamai.net),84.53.132.80,84.53.132.88 3364.000000,348.000000,15.000000,15.000000 $ dig -x 84.53.132.88 +short static.ak.facebook.com.C-EU.120823T143707. For many "cloud" IP addresses, it won't necessarily be useful, but in many case, it gives more useful information than the real PTR record. Above, it tells us that 84.53.132.88 was last the result of a query for an A record for [static.ak.facebook.com](http://static.ak.facebook.com) (at 14:37:07), and it gives you the result of the geoiplookup. It can be generalised for other things (like for internal IP addresses, I use other sources of information to feed the powerdns database). If anybody is interested, I can post the intructions on how to set it up along with the small perl script that parses the bro dns logs here or on github. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 23, 2012, 3:15pm UTC](https://community.zeek.org/t/reverse-dns-based-on-bros-forward-dns-query-log/2418/2 "2012-08-23T15:15:23Z")
That's cool! Definitely send along anything you can. I'm sure that quite a few people will be interested in this (I am). In 2.2 we should have some database logging framework writer plugins so we might be able to remove your script eventually and have Bro send these logs directly to the database. Yet another cool Bro thing! You're on a roll today. FYI, the mailing list address is [bro@bro-ids.org](mailto:bro@bro-ids.org) now. The old [lbl.gov](http://lbl.gov) address was deprecated a while ago. .Seth ---
**Author:** ![Stephane\_Chazelas](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Stephane\_Chazelas](https://community.zeek.org/u/Stephane_Chazelas)\ **Post date:** [August 24, 2012, 2:41pm UTC](https://community.zeek.org/t/reverse-dns-based-on-bros-forward-dns-query-log/2418/3 "2012-08-24T14:41:40Z")
2012-08-23 11:15:23 -0400, Seth Hall: > \> tail \-1 dns\.log > 1345732627\.030897 jUJU3ZwGOv4 x\.x\.x\.x 54866 x\.x\.x\.x 53 udp 44687 static\.ak\.facebook\.com 1 C\_INTERNET 1 A 0 NOERROR F F > F T T 0 static\.ak\.facebook\.com\.edgesuite\.net,a749\.dsw4\.akamai\.net,84\.53\.132\.80,84\.53\.132\.88 3364\.000000,348\.000000,15\.000000,15\.000000 > > dig -x 84.53.132.88 +short > \> static.ak.facebook.com.C-EU.120823T143707. > > That's cool! Definitely send along anything you can. I'm sure that quite a few people will be interested in this (I am). [...] Here you go: > **[GitHub - stephane-chazelas/bro-pdns-forward-dns: How to setup a DNS server to...](https://github.com/stephane-chazelas/bro-pdns-forward-dns)** > > How to setup a DNS server to serve PTR records based on Bro's log of forward DNS lookups - GitHub - stephane-chazelas/bro-pdns-forward-dns: How to setup a DNS server to serve PTR records based ... please test and tell me what you think. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/reverse-dns-based-on-bros-forward-dns-query-log/2418/4 "2022-05-06T15:40:32Z")
Closed on May 6, 2022, 3:40pm UTC