DNSWatch - DNS Traffic Sniffer and Analyzer

[HalilDeniz]

DNSWatch - DNS Traffic Sniffer and Analyzer

DNSWatch is a Python-based tool that allows you to sniff and analyze DNS (Domain Name System) traffic on your network. It listens to DNS requests and responses and provides insights into the DNS activity.

Features

link of the DNSWatch

• Sniff and analyze DNS requests and responses.
• Display DNS requests with their corresponding source and destination IP addresses.
• Optional verbose mode for detailed packet inspection.
• Save the results to a specified output file.
• Filter DNS traffic by specifying a target IP address.
• Save DNS requests in a database for further analysis(optional)
• Analyze DNS types (optional).
• Support for DNS over HTTPS (DoH) (optional).

Usage

python dnswatch.py -i <interface> [-v] [-o <output_file>] [-k <target_ip>] [--analyze-dns-types] [--doh]

• -i, --interface: Specify the network interface (e.g., eth0).
• -v, --verbose: Use this flag for more verbose output.
• -o, --output: Specify the filename to save results.
• -t, --target-ip: Specify a specific target IP address to monitor.
• -adt, --analyze-dns-types: Analyze DNS types.
• --doh: Use DNS over HTTPS (DoH) for resolving DNS requests.
• -fd, --target-domains: Filter DNS requests by specified domains.
• -d, --database: Enable database storage for DNS requests.
• -p, --pcap: Save captured packets to a .pcap file
  Press Ctrl+C to stop the sniffing process.

[noptrix]

@HalilDeniz , thank you - have you considered creating a pull request (PR) instead of spending time on writing a lengthy description for this tool? For "tool requests," a concise description along with a link to the relevant URL is typically sufficient. Just a friendly suggestion.

[noraj]

spending time on writing a lengthy description

That's copy pasta from upstream README but yeah @HalilDeniz you can take a look at https://wiki.archlinux.org/title/PKGBUILD and https://github.com/BlackArch/blackarch-pkgbuilds and come with a Merge Request if you wouldl like.

[D3vil0p3r]

@HalilDeniz solve this HalilDeniz/DNSWatch#17

[D3vil0p3r]

Packaged as standalone and it works correctly: #4381