2

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. Assume the host is at least several hops away.

Now I know that DNS is hierarchial and can involve many parties as queries are propagated. Is there any way to configure the domain or dns server in such a way that lookups from a host encourage that host to connect to the dns server directly or otherwise give up its IP address?

I have a hunch it's possible because sometimes I try to lookup the IP of a hostname and it times out, suggesting my host was unable to reach certain nameservers (directly).

Thanks. This is part of a honeypot proof of concept project I'm cooking up.

5

Is there any way to configure the domain or dns server in such a way that lookups from a host encourage that host to connect to the dns server directly or otherwise give up its IP address?

That's not how DNS works.

Usually a client only connects to a local DNS server (given by DHCP, by the ISP...) and let this server resolve the full query. This server then might do a full recursive query or might forward the question to another DNS server etc. In typical setups this means that one cannot distinguish between different clients but only between different ISP. Additionally you get requests from other public DNS server like google or OpenDNS. Only few requests will originate from inside other networks or from the clients directly because they use their own recursive DNS resolver.

Apart from that results are cached on all levels of the DNS lookup chain, so you will only detect a part of the lookups because most will be answered by cached responses already.

  • Thank you Steffen. If I understand correctly, the closest I can come to the hosts's IP is the hosts's recursive DNS server's IP in the case where the recursive DNS server's cached copy of my domain details expires and it contacts my nameserver for the update...? So if for example the host uses a google nameserver to perform the lookup, it may trigger a connection from a google nameserver to my domain's nameserver...? – Brad Hein Dec 31 '15 at 18:59
  • @BradHein: exactly – Steffen Ullrich Dec 31 '15 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.