Unit 5: How DNS answers · Lesson 3 of 6 · 15 min
When names do not exist
Read the status of every answer and know what a burst of failures means.
mission
- You are
- The analyst triaging a DNS alert.
- Situation
- An alert fired for a burst of failed lookups. Before reading logs you want to be sure what a failure looks like.
- Goal
- Read the status in a DNS answer and count failures in a capture.
- Hand in
- The status for a name that does not exist and the number of failed answers in dns.pcap.
Read the status
Every answer carries a status in its header: NOERROR means the name exists, NXDOMAIN means it does not exist at all.
dig @127.0.0.1 nothing.corp.example | grep -o 'status: [A-Z]*' status: NXDOMAIN dig @127.0.0.1 www.corp.example | grep -o 'status: [A-Z]*' status: NOERROR
The header line of a failed lookup
- 1
status: NXDOMAINthe verdict: this name does not exist - 2
id: 40147random query id, matched against the reply
Count failures in a capture
In captures the status is dns.flags.rcode. 3 means NXDOMAIN.
tshark -r dns.pcap -Y 'dns.flags.rcode==3' | wc -l
40
you should see Forty failed answers, all in a short window.
defender tip One client getting many NXDOMAIN answers is a classic sign of malware trying generated domain names, or of data hidden in the names themselves. Both come up again later in the course.
Status codes
| Command | What it does |
|---|---|
NOERROR (0) | The name exists. It may still have no record of the type you asked |
SERVFAIL (2) | The resolver could not get an answer, often a broken zone or DNSSEC failure |
NXDOMAIN (3) | The name does not exist |
REFUSED (5) | The server will not answer you |
Find who received the failures
NXDOMAIN answers go back to the client that asked. Group them by destination.
tshark -r dns.pcap -Y 'dns.flags.rcode==3' -T fields -e ip.dst | sort | uniq -c
40 10.10.0.57
you should see All 40 failures went to one laptop, 10.10.0.57.
Spot the third case
Some failures are neither NXDOMAIN nor a timeout. The name exists, but the answer section is empty.
dig @127.0.0.1 api.corp.example A +noall +comments | grep -oE 'status: [A-Z]+|ANSWER: [0-9]+'
status: NOERROR
ANSWER: 0
you should see NOERROR with zero answers. Callers fail just as hard.
What a defender takes away
- 1Every DNS answer has a status. Read it before the data.
- 2Bursts of NXDOMAIN from one client deserve a look.
- 3Each query carries a random ID and source port, which makes forged answers hard to slip in.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.