0

When I'm scanning with Nmap, I make an effort to get proper hostnames associated with the target IPs. To do this, I scan UDP 53 on the targets to identify DNS servers and then run something like the following for each identified DNS server:

nmap -sL -v4 --dns-servers DNSSERVER TARGETS

I have to review the results for each tested DNS server to see how many of the targets it can resolve, and also determine if the resolved targets differ.

The docs seem to imply that if you specify multiple servers in the --dns-servers flag, that it will choose one at random (or round robin). This interpretation comes from the "is often faster" part.

The problem I have is that my scan targets may not all be supported by the same DNS server. In my case, I'd rather specify all identified DNS servers in --dns-servers and have it fail over until it finds one that returns a response. If only one of the specified servers is used, to get accurate results I would need to perform multiple scans, each with a single DNS server specified.

My question is, is it true that the --dns-server flag will use only one of the specified DNS servers, and not try them all?

Improve this question
1
  • run a packet capture and find out?
    – schroeder ♦
    Aug 14, 2020 at 20:49

1 Answer 1

Reset to default
1

From simple experimentation, I can tell you:

  1. If you give it two addresses, and one isn't a DNS server, it gets full responses from the other server (but has to wait for a timeout).
  2. If you give it two addresses of viable DNS servers, it gets about half from each.
  3. When one DNS server reports NXDOMAIN (i.e. no records), it does not try the other one.

The raw data: I used your scan for 256 hosts. I captured, with tcpdump, at a router, packets for one of the DNS server. It reported:

237 packets captured
257 packets received by filter
19 packets dropped by kernel

which would be 128 requests and 128 replies. (I'm not sure why the "received" is +1).

So half the queries went here when the other DNS server, and no requeries where performed when the first server reported no name.

For the record (a debian build on a Raspberry PI):

$ nmap --version
Nmap version 7.80 ( https://nmap.org )
Platform: arm-unknown-linux-gnueabihf
Compiled with: liblua-5.3.3 openssl-1.1.1g libssh2-1.8.0 libz-1.2.11 libpcre-8.39 libpcap-1.9.1 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .