Skip to main content
Version: 2.10.0

DNS Users Monitor (10005, 20005)

Description ​

This Module reports DNS users by monitoring DNS traffic (dest_port=53). It consolidates NetFlow records over a period of time (Data Collection Interval) which all have the same combination of the following fields:

  • Source IP address
  • Destination IP address
  • Destination port number
  • Layer 3 protocol

This information is provided per NetFlow exporter.

Parameters ​

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 30 sec, max = 600 sec, default = 60 sec
How many most active DNS requestors do you want to report?Top N (number of reported hosts)min = 0, max = 100000, default = 0 (0 indicates all hosts are reported)

Input ​

NetFlow v5, v9, IPFIX, Cisco ASA NSEL, Palo Alto Networks NetFlow v9, sFlow, AWS GCP VPC Flow logs, Azure NSG Flow logs.

Required NetFlow fields ​

Information Element (IE)IE idIE size, BDescription
IPv4​​​
sourceIPv4Address84The IPv4 source address in the IP packet header
destinationIPv4Address124The IPv4 destination address in the IP packet header
IPv6​​​
sourceIPv6Address2716The IPv6 source address in the IP packet header
destinationIPv6Address2816The IPv6 destination address in the IP packet header
protocolIdentifier41The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.
sourceTransportPort72The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header.
destinationTransportPort72The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header.

Syslog/JSON Message Fields ​

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20005”
exp_ipNetFlow exporter IP address<IPv4_address>
protocolTransport Protocol (TCP = 6, UDP = 17)<number>
src_ipSource host IPv4 address<IPv4_address>
src_ip6Source host IPv6 address<IPv6_address>
dest_ipDNS server IPv4 address<IPv4_address>
dest_ip6DNS server IPv6 address<IPv6_address>
dest_portDestination port number53
packets_inPackets in the flow<number>
bytes_inBytes in the flow<number>
flow_countNumber of flows<number>
t_intObservation time interval, msec<number>