Skip to content

feature/dns_module_resolved_ips #862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jboddey merged 3 commits into from
Oct 8, 2024
Merged

feature/dns_module_resolved_ips #862

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
133f2a7
Add resolved ip addresses from dns queries to dns module report
jhughesoti Oct 7, 2024
744077b
update dns report
jhughesoti Oct 7, 2024
1605c75
Merge branch 'dev' into feature/dns_module_resolved_ips
jboddey Oct 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 24 additions & 8 deletions modules/test/dns/python/src/dns_module.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ def generate_module_report(self):
<tr>
<th>Source</th>
<th>Destination</th>
<th>Resolved IP</th>
<th>Type</th>
<th>URL</th>
<th>Count</th>
Expand All @@ -105,16 +106,16 @@ def generate_module_report(self):
<tbody>'''

# Count unique combinations
counter = Counter(
(row['Source'], row['Destination'], row['Type'], row['Data'])
for row in dns_table_data)
counter = Counter((row['Source'], row['Destination'], row['ResolvedIP'],
row['Type'], row['Data']) for row in dns_table_data)

# Generate the HTML table with the count column
for (src, dst, typ, dat), count in counter.items():
for (src, dst, res_ip, typ, dat), count in counter.items():
table_content += f'''
<tr>
<td>{src}</td>
<td>{dst}</td>
<td>{res_ip}</td>
<td>{typ}</td>
<td>{dat}</td>
<td>{count}</td>
Expand Down Expand Up @@ -166,23 +167,38 @@ def extract_dns_data(self):
# 'qr' field indicates query (0) or response (1)
dns_type = 'Query' if dns_layer.qr == 0 else 'Response'

# Check for the presence of DNS query name
if hasattr(dns_layer, 'qd') and dns_layer.qd is not None:
# Check if 'qd' (query data) exists and has at least one entry
if hasattr(dns_layer, 'qd') and dns_layer.qdcount > 0:
qname = dns_layer.qd.qname.decode() if dns_layer.qd.qname else 'N/A'
else:
qname = 'N/A'

resolved_ip = 'N/A'
# If it's a response packet, extract the resolved IP address
# from the answer section
if dns_layer.qr == 1 and hasattr(dns_layer,
'an') and dns_layer.ancount > 0:
# Loop through all answers in the DNS response
for i in range(dns_layer.ancount):
answer = dns_layer.an[i]
# Check for IPv4 (A record) or IPv6 (AAAA record)
if answer.type == 1: # Indicates an A record (IPv4 address)
resolved_ip = answer.rdata # Extract IPv4 address
break # Stop after finding the first valid resolved IP
elif answer.type == 28: # Indicates an AAAA record (IPv6 address)
resolved_ip = answer.rdata # Extract IPv6 address
break # Stop after finding the first valid resolved IP

dns_data.append({
'Timestamp': float(packet.time), # Timestamp of the DNS packet
'Source': source_ip,
'Destination': destination_ip,
'ResolvedIP': resolved_ip, # Adding the resolved IP address
'Type': dns_type,
'Data': qname[:-1]
})

# Filter unique entries based on 'Timestamp'
# DNS Server will duplicate messages caught by
# startup and monitor
filtered_unique_dns_data = []
seen_timestamps = set()

Expand Down
99 changes: 98 additions & 1 deletion testing/unit/dns/reports/dns_report_local.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,98 @@
<h1>DNS Module</h1> <table class="module-summary"> <thead> <tr> <th>Requests to local DNS server</th> <th>Requests to external DNS servers</th> <th>Total DNS requests</th> <th>Total DNS responses</th> </tr> </thead> <tbody> <tr> <td>71</td> <td>0</td> <td>71</td> <td>84</td> </tr> </table> <table class="module-data"> <thead> <tr> <th>Source</th> <th>Destination</th> <th>Type</th> <th>URL</th> <th>Count</th> </tr> </thead> <tbody> <tr> <td>10.10.10.14</td> <td>10.10.10.4</td> <td>Query</td> <td>mqtt.googleapis.com</td> <td>64</td> </tr> <tr> <td>10.10.10.4</td> <td>10.10.10.14</td> <td>Response</td> <td>mqtt.googleapis.com</td> <td>76</td> </tr> <tr> <td>10.10.10.14</td> <td>10.10.10.4</td> <td>Query</td> <td>pool.ntp.org</td> <td>7</td> </tr> <tr> <td>10.10.10.4</td> <td>10.10.10.14</td> <td>Response</td> <td>pool.ntp.org</td> <td>8</td> </tr> </tbody> </table>
<h1>DNS Module</h1>
<table class="module-summary">
<thead>
<tr>
<th>Requests to local DNS server</th>
<th>Requests to external DNS servers</th>
<th>Total DNS requests</th>
<th>Total DNS responses</th>
</tr>
</thead>
<tbody>
<tr>
<td>71</td>
<td>0</td>
<td>71</td>
<td>84</td>
</tr>
</table>

<table class="module-data">
<thead>
<tr>
<th>Source</th>
<th>Destination</th>
<th>Resolved IP</th>
<th>Type</th>
<th>URL</th>
<th>Count</th>
</tr>
</thead>
<tbody>
<tr>
<td>10.10.10.14</td>
<td>10.10.10.4</td>
<td>N/A</td>
<td>Query</td>
<td>mqtt.googleapis.com</td>
<td>64</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>173.194.195.206</td>
<td>Response</td>
<td>mqtt.googleapis.com</td>
<td>38</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>2607:f8b0:4001:c11::ce</td>
<td>Response</td>
<td>mqtt.googleapis.com</td>
<td>32</td>
</tr>
<tr>
<td>10.10.10.14</td>
<td>10.10.10.4</td>
<td>N/A</td>
<td>Query</td>
<td>pool.ntp.org</td>
<td>7</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>N/A</td>
<td>Response</td>
<td>pool.ntp.org</td>
<td>4</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>5.78.89.3</td>
<td>Response</td>
<td>pool.ntp.org</td>
<td>2</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>199.68.201.234</td>
<td>Response</td>
<td>pool.ntp.org</td>
<td>2</td>
</tr>
<tr>
<td>10.10.10.4</td>
<td>10.10.10.14</td>
<td>2607:f8b0:4001:c08::ce</td>
<td>Response</td>
<td>mqtt.googleapis.com</td>
<td>6</td>
</tr>
</tbody>
</table>