Problem DNS Queries

bundle

#1

###Bundle details and download
https://www.extrahop.com/bundles/gumby/problem-dns-queries/

###Description
Out of the box this bundle looks for four known ‘problem’ DNS queries:

  • DNS-SD – this is not regular DNS but related to Bonjour and usually represents unnecessary traffic on your network,
  • isatap – this is IPv6 over IPv4 tunneling, if you are an IPv4 only shop, this is probably unnecessary traffic on your network, you may be able to turn this off, enabled by default on Win7 and Server2008,
  • wpad – this is Web Proxy Auto Discovery, configure a wpad host on your network or turn this off, all major browsers support wpad, this can present a security risk if left enabled and unconfigured,
  • reverse DNS – like the name suggests, this converts IP addresses into hostnames, reverse DNS is often ‘broken’ or is fine on some subnets but broken for other subnets.

How to minimize DNS Query Errors from some Host like wpad,isatap,...?
#2

Is it possible to narrow down the results of these pages to show when the DNS query resulted in an error?


#3

Certainly. There are ultimately several ways one could do this. Probably the quickest way is to drill into the DNS “All Activity” page.

  1. Click on Metrics along the top navigation
  2. Along the navigation on the left, click on “Applications” under Sources
  3. Then click on “All Activity”

  1. Then, navigate to “DNS” along the left and you’ll see our detailed DNS activity page. From here, there are a number of ways you can drill into our DNS statistics. One of the areas of this screen displays statistics for each DNS response code (think DNS errors). From here you can click on the blue hyperlinks to drill into the devices responsible for the DNS errors, or the host query associated with the error.


#4

a couple different options to answer your question:

1.) Navigate to Metrics => Applications => All Activity => DNS
Click the Errors KPI button in the top row under the Recent Pages icon
This will take you to the errors details page.
Add the following regular expression to the filter at the bottom of the page:
/dns-sd|in-addr.arpa|wpad|isatap/

This is the list of Host Queries received an error on Response.
Each is a click-able link to the list of DNS clients that Request that host resolution.

2.) You could also modify the trigger that Cal wrote if you wanted to aggregate them in one set of metrics. That is a more advanced use case, but happy to help if that’s what interests you.

3). Lastly, if you are an Explore appliance customer (and everyone should be!) you can almost automagically send each of these detail records to your EXA cluster for near unlimited slicing and dicing!!! boggles the mind just thinking about it…

HTH!!!


#5

Actually - got me curious - here’s an update that has the error (and timeout metrics added.

The update looks at Response errors and adds base and detail metrics to the application.
The pages are updated to reflect the new error metrics for Problem DNS queries.

As an extra added ingredient, I added a dashboard (pretty!!!) that shows the Totals for each category,
The client IPs that make up the totals, and Client IPs for errors as well.

As you fix your environment, you will se the rates decrease and clients disappear from the lists!


#6

Right, so I’m used those methods before, problem is they show client/server as both DNS servers. I assume because the client asking the DNS server can’t get the answer, so that DNS server has to forward the query on up another level. See attached.

Interesting chart in that last post. How do I add that? You said you updated it, a new bundle I can download? And, those error charts on the right – they include SERVERFAIL/NXDOMAIN/etc type errors?

See attached to better explain – both client & server are DNS servers.


#7

@mbc360: i can’t post the customization directly - if you unicast me at thughes (extrahop.com) i can send you the customization for this.


#8

Looks like it’s been a while for this topic but I downloaded the bundle, tried to upload it to my Discover appliance and I get an error: ‘error return without exception set’. Anyone have a fix for that?

Thanks!