# Using Bro to detect DNS lookups in given timeframe

**URL:** <https://community.zeek.org/t/using-bro-to-detect-dns-lookups-in-given-timeframe/3524>\
**Category:** Zeek\
**Created:** [March 18, 2015, 4:28pm UTC](https://community.zeek.org/t/using-bro-to-detect-dns-lookups-in-given-timeframe/3524 "2015-03-18T16:28:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hille\_Samson](https://avatars.discourse-cdn.com/v4/letter/h/3d9bf3/32.png) [@Hille\_Samson](https://community.zeek.org/u/Hille_Samson)\
**Post date:** [March 18, 2015, 4:28pm UTC](https://community.zeek.org/t/using-bro-to-detect-dns-lookups-in-given-timeframe/3524/1 "2015-03-18T16:28:09Z")

</div>

Does Bro have anything built-in for the following scenario:

· Detecting if a network device is looking up over 50 DNS entries in a 1 hour timeframe

**Samson Hille**

IT Security Analyst

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [March 18, 2015, 4:57pm UTC](https://community.zeek.org/t/using-bro-to-detect-dns-lookups-in-given-timeframe/3524/2 "2015-03-18T16:57:08Z")

</div>

There is nothing built in right now, but it would be pretty easy to write a script to do it. Here’s a quick one...

event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;local r1 = SumStats::Reducer($stream="too\_much\_dns.recursive\_requests", $apply=set(SumStats::SUM));  
&nbsp;&nbsp;SumStats::create([$name="too\_much\_dns",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$epoch=1hr,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$reducers=set(r1),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$threshold\_val(key: SumStats::Key, result: SumStats::Result) =  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return result["too\_much\_dns.recursive\_requests"]$sum;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$threshold=5.0,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$threshold\_crossed(key: SumStats::Key, result: SumStats::Result) =  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local r = result["too\_much\_dns.recursive\_requests"];  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local dur = duration\_to\_mins\_secs(r$end-r$begin);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local message = fmt("%s did at least %.0f recursive DNS requests in %s", key$host, r$sum, dur);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print message;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}]);  
&nbsp;&nbsp;}

event dns\_request(c: connection, msg: dns\_msg, query: string, qtype: count, qclass: count)  
&nbsp;&nbsp;{  
&nbsp;&nbsp;if ( msg$RD )  
&nbsp;&nbsp;&nbsp;&nbsp;SumStats::observe("too\_much\_dns.recursive\_requests", [$host=c$id$orig\_h], [$num=1]);  
&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/using-bro-to-detect-dns-lookups-in-given-timeframe/3524/3 "2022-05-06T15:42:32Z")

</div>