Skip to main content
Monitoring DNS can be complex, but this guide highlights several techniques to help you get started. Use these methods to troubleshoot and understand DNS behavior in containerized environments and Kubernetes setups.
In this guide, we cover DNS monitoring using tools such as netshoot, Wireshark, and tcpdump. We also demonstrate how to trace network system calls and review the detailed output from DNS queries.

​
Using Docker and netshoot for DNS Monitoring

If you’re on macOS, one quick way to access various networking tools is by running the netshoot Docker image. This container includes pre-installed utilities that are perfect for DNS troubleshooting in containerized setups. To run the netshoot container, execute:
Inside the container, you can use tools like strace to trace system calls. For instance, the command below monitors network-related system calls during a DNS lookup. The -f flag instructs strace to follow any child processes, ensuring comprehensive activity logging, and the -e trace=network option limits the output to network system calls:
When you search for the term “connect” in the output, you may notice it is followed by corresponding send and receive operations. This indicates which nameserver provides the DNS answer. For example, the beginning of the output might look like this:
The above output typically originates from the resolver within the Docker environment. Recursive resolvers come pre-configured with a list of IP addresses (root hints) for the root nameservers, ensuring proper initiation of the DNS resolution process.

​
Analyzing DNS Resolution Steps

Following the resolution chain further reveals subsequent nameserver responses. In the next example, the second DNS response is received from a different IP address:
This segment of the strace output shows communication with the nameserver at IP address 205.251.195.12:
A reverse DNS lookup confirms that the IP address 205.251.195.12 is associated with an AWS nameserver. Use the following command:
The output confirms the AWS nameserver mapping:
This indicates that the recursive resolver likely returned a cached answer for the AWS nameserver’s IP instead of performing a full DNS resolution from scratch.

​
Monitoring DNS Traffic with Wireshark

Another powerful tool for DNS monitoring is Wireshark. On macOS, Wireshark enables you to capture and inspect DNS traffic in real time. After launching Wireshark, follow these steps:
  1. Select the network interface (typically EN0 for internet connectivity).
  2. Apply a filter to display only DNS traffic. A common filter is to capture UDP and TCP traffic on port 53.
  3. Run a DNS query, for example:
The resulting output might resemble:
This packet information lets you drill down into the query and response details, enabling deeper insights into DNS operations.

​
Capturing DNS Traffic with tcpdump

For command-line enthusiasts, tcpdump provides an effective way to monitor DNS traffic. Use the command below to capture all traffic on the default DNS port (53):
After authenticating, tcpdump will begin displaying live DNS traffic. Below is an example snippet from tcpdump output:
Because DNS logs can be very detailed, leveraging AI chatbots or other interpretative tools can help demystify the complex outputs from tools like tcpdump.

​
Conclusion

Effective DNS monitoring requires the use of multiple tools and techniques. By combining the use of netshoot for system call tracing, Wireshark for detailed packet analysis, and tcpdump for capturing live traffic, you can gain valuable insights into your DNS processes. Remember to always handle log data carefully and avoid exposing any sensitive information. Happy monitoring!

Watch Video