DNSQuerySniffer

DNSQuerySniffer v1.05
Copyright (c) 2013 Nir Sofer
Web site: http://www.nirsoft.net

Description

DNSQuerySniffer is a network sniffer utility that shows the DNS queries sent on your system. For every DNS query, the following information is displayed: Host Name, Port Number, Query ID, Request Type (A, AAAA, NS, MX, and so on), Request Time, Response Time, Duration, Response Code, Number of records, and the content of the returned DNS records.
You can easily export the DNS queries information to csv/tab-delimited/xml/html file, or copy the DNS queries to the clipboard, and then paste them into Excel or other spreadsheet application.

System Requirements

  • This utility works on any version of Windows, starting from Windows 2000, and up to Windows 8. Both 32-bit and 64-bit systems are supported.
  • On some systems, capturing packets with the 'Raw Sockets' method may not work properly, and thus you'll need to install the WinPcap capture driver or the Network Monitor driver.
    Even if the 'Raw Sockets' method works properly on your system, it's recommended to install the WinPcap capture driver or Microsoft Network Monitor driver (version 3.4 or later) in order to get more accurate date/time information ('Request Time', 'Response Time', and 'Duration' columns)
  • In order to use the Network Monitor driver on 64-bit systems, you have to download the x64 version of DNSQuerySniffer.

Versions History

  • Version 1.05:
    • Added 'Source Address' and 'Destination Address' columns.
  • Version 1.00 - First release.

Start Using DNSQuerySniffer

Except of a capture driver that you may need to install, DNSQuerySniffer doesn't require any installation process or additional dll files. In order to start using it, simply run the executable file - DNSQuerySniffer.exe
After running DNSQuerySniffer in the first time, the 'Capture Options' window appears on the screen, and you're requested to choose the capture method and the desired network adapter. In the next time that you use DNSQuerySniffer, it'll automatically start capturing packets with the capture method and the network adapter that you previously selected. You can always change the 'Capture Options' again by pressing F9.

After choosing the capture method and network adapter, DNSQuerySniffer starts the displays the detail of every DNS query sent on your system.
You can press F6 to stop the DNS capture, F5 to start it again, or Ctrl+X to clear the current DNS queries list.

You can select one or more DNS query lines, and then use the 'Save Selected Items' option to export them into csv/tab-delimited/xml/html file. You can also copy the selected DNS queries to the clipboard (Ctrl+C) and then paste them (Ctrl+V) into Excel or other spreedsheet application.

DNSQuerySniffer Columns

  • Host Name: The host name to query
  • Port Number: The client UDP port that was used to send the DNS query.
  • Query ID: The ID of the query.
  • Request Type: The type of the DNS request - A, AAAA, NS, MX, and so on...
  • Request Time: The exact time that the DNS request was sent. The time is specified in absolute date/time or relative to the capture start, depending on what you choose in Options -> Time Display Mode.
    Be aware that this column displays more accurate result when using WinPcap driver or Microsoft Network Monitor driver, version 3.4 or later.
  • Response Time: The exact time that the DNS response was received. The time is specified in absolute date/time or relative to the capture start, depending on what you choose in Options -> Time Display Mode.
    Be aware that this column displays more accurate result when using WinPcap driver or Microsoft Network Monitor driver, version 3.4 or later.
  • Duration: The time difference in milliseconds between the Request Time and Response Time.
  • Response Code: The returned response code. If the response code is not 'Ok', it means that the DNS server returned an error, and the bullet icon will be in red instead of green.
  • Records Count: Total number of records returned by the DNS server.
  • A: Displays the IP addresses list (IPv4) returned by the DNS server.
  • AAAA: Displays the IP addresses list (IPv6) returned by the DNS server.
  • CNAME: Displays the CNAME record returned by the DNS server.
  • NS: Displays the NS records returned by the DNS server.
  • MX: Displays the MX records returned by the DNS server.
  • PTR: Displays the PTR records returned by the DNS server.
  • SOA: Displays the SOA record returned by the DNS server.
  • Source Address: The IP address of the client that sent the DNS query.
  • Destination Address: The IP address of the DNS server that received the DNS query.

Translating DNSQuerySniffer to other languages

In order to translate DNSQuerySniffer to other language, follow the instructions below:
  1. Run DNSQuerySniffer with /savelangfile parameter:
    DNSQuerySniffer.exe /savelangfile
    A file named DNSQuerySniffer_lng.ini will be created in the folder of DNSQuerySniffer utility.
  2. Open the created language file in Notepad or in any other text editor.
  3. Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to your Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the 'About' window.
  4. After you finish the translation, Run DNSQuerySniffer, and all translated strings will be loaded from the language file.
    If you want to run DNSQuerySniffer without the translation, simply rename the language file, or move it to another folder.

License

This utility is released as freeware. You are allowed to freely distribute this utility via floppy disk, CD-ROM, Internet, or in any other way, as long as you don't charge anything for this and you don't sell it or distribute it as a part of commercial product. If you distribute this utility, you must include all files in the distribution package, without any modification !

Disclaimer

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

Feedback

If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to nirsofer@yahoo.com