DNS logger & firewall for Win32

[electronixtar]

Hi all

I have a nasty ISP that tampers the UDP port 53 traffic all the time, but it does not accurs often. I need to gather some evidence and see if there's pattern. So I need a DNS firewall and a logger.

Are there any software that loggs every Windows gethostbyname() queries, and blocks incorrect answers with a rule?

[thorazine74]

Dont know about blocking incorrect answers, but if you use Acrylic DNS Proxy you can see some sort of log of all dns queries, but they will be made by Acrylic, not Windows.

[electronixtar]

Dont know about blocking incorrect answers, but if you use Acrylic DNS Proxy you can see some sort of log of all dns queries, but they will be made by Acrylic, not Windows.

quite awesome software, defintely gonna try it out. Thank you!

[electronixtar]

OK, I need a blacklist patch for Acrylic DNS Proxy, can DC help me out?

[4wd]

With your ISP screwing around with the DNS queries wouldn't it be better to run your own DNS server?

eg. Treewalk

[Ehtyar]

If they're tampering with the actual traffic on port 53, as opposed to just records from their own DNS servers (the impression I got), then you could probably prove it by using DNSSEC (will only work for certain TLDs though, .org is probably easiest).

Ehtyar.

[electronixtar]

With your ISP screwing around with the DNS queries wouldn't it be better to run your own DNS server?

eg. Treewalk

It's slow and costs too much memory if you run long enough. Not worth it.

If they're tampering with the actual traffic on port 53, as opposed to just records from their own DNS servers (the impression I got), then you could probably prove it by using DNSSEC (will only work for certain TLDs though, .org is probably easiest).

Ehtyar.

DNSSec is cool, but not all of TLD have it.

[Ehtyar]

But purely in order to prove your DNS is being tampered with, it's the perfect solution. BIND is very reasonable with memory, despite what others may say about it...

Ehtyar.