Take the 2-minute tour ×

Could anyone help me in finding any source which provides raw DNS log data. I don't want processed DNS logs. Any help is appreciated.

Thanks in Advance.

share|improve this question
add comment

1 Answer

You haven't given any specifics: what OS, what DNS software you're running. I'll throw some random stuff out there to answer your vague question, and hope for the best.

You can't get any more raw in your logs than tcpdump. This is kind of a brutal solution that uses lots of CPU and disk space. If this is what you really want, and your name server isn't that active, you have a short window of time that you want to debug a specific problem, then this might be for you.

as root, do something like this, and you'll save all traffic destined to your dns server: set the INTERFACE and MYSERVERIP variables as appropriate...

tcpdump -nn -i $INTERFACE -s 0 -c 100000 -w foo.cap port 53 and dst $MYSERVERIP

This will store 100,000 dns queries into the file foo.cap

You can get a brief summary of the dns traffic with tcpdump -nn -r foo.cap You can get a fully exploded super-detailed view of the dump file with tshark -nn -r foo.cap -V

share|improve this answer
add comment

Your Answer


