3

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would be effective ways of specifically logging those connections?

The purpose is to get a clear picture of all outgoing traffic, and find out what portion of outgoing traffic is sent by a given endpoint to remote hardcoded IP addresses (thus bypassing DNS resolution).

2
  • 1
    Log all outgoing destinations? I'm not sure why DNS queries have an effect. Are you looking to monitor traffic from one machine or a network?
    – schroeder
    Feb 22, 2020 at 17:33
  • From one machine. I've slightly edited my question to clarify what I am looking for.
    – John Blatz
    Feb 23, 2020 at 13:55

3 Answers 3

3

Using native functionality in Windows, the best method would be to enable Audit Filtering Platform Connection. It can log all connections allowed by the Windows Firewall. The following is an excerpt:

Audit Filtering Platform Connection determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform.

Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs).

This subcategory contains Windows Filtering Platform events about blocked and allowed connections, blocked and allowed port bindings, blocked and allowed port listening actions, and blocked to accept incoming connections applications.

The downside with enabling this auditing is the audit volume will be HIGH. Can't stress that enough.

From here you'll need a custom script or some other means to aggregate the DNS query logs and the Windows Filtering Platform (WFP) events to determine what IP addresses were accessed without performing a DNS lookup.

For example,

  1. Build list of all unique destination IP addresses for a host.
  2. Search DNS replies to that host for IP addresses from #1.

What you're aiming to achieve is difficult. Some application may use hard-coded IP addresses or other means to resolve a destination (NetBIOS, WINS, LLMNR, Bonjour, etc.). Depending on your environment, don't be surprised to find a number of false-positives during your investigation.

As an alternative, place a network monitoring device in front of the target system(s). Products such as Zeek (formerly Bro), Argus, SiLK, or RITA would all log network connections, in addition to other interesting data, and don't cost any money. In some instances they will even log DNS queries. This alternative approach will still require a custom script to aggregate the DNS query logs with network connections to find which were established without using traditional DNS.

2

You can monitor (and log) all incoming and outgoing network connections using Windows Process Monitor and TCPView, which are included in Windows Sysinternals. For more information on how to use these tools, see http://technet.microsoft.com/en-us/sysinternals/bb896645 and http://technet.microsoft.com/en-us/sysinternals/bb897437.

-3

Use a MITM proxy for reading all the traffic. Ethercap is another way

1
  • 1
    Why would it require MITM?
    – peterh
    Feb 22, 2020 at 23:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .