0

I installed a DNS server on a Raspberry PI to monitor DNS requests. One request that is curious is "fscta65w.com." It keeps showing up in the querlog from a macbookPro but I can't seem to find out the purpose of it.

My question is, how can I find the process that is submitting that request so I can delete/shutdown?

And yes, I did my research and found the below reference to a similar post but w/o any resolution.

Forensics - trace back DNS query origin on host?

|improve this question
  • The question you linked is an exact duplicate. Please do not post duplicate answers because you do not think there were enough answers. Bring more attention to the older question, instead. The supplied answer is a good one, though. – schroeder♦ Oct 17 at 6:50
  • Yeah, will do that. Agree, the answer is fine but it's 4 years old and was really looking for a way to get an alert or log a process when it opens a port. Anyway, I'll move on. thnx – PidePython Oct 17 at 14:29
  • That becomes a scripting exercise (and isn't really a security concern). It can be done, but it's not straightforward. – schroeder♦ Oct 17 at 17:20

Browse other questions tagged or ask your own question.