I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source address as the one from the DNS server.

How do I forward all requests to ns.example.com to an isolated server to see which PC is making the requests?

  • 1
    Can you just set a record in your DNS server for that domain that points to a local server under your control? Does the DNS server not have its own logs? – Xiong Chiamiov Dec 1 '16 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.