After introducing stash53 (which logs DNS queries and responses with Logstash) yesterday, I got quite a bit of positive feedback. There were a couple of queries whether I could explain what people can do with stash53’s optional MQTT emitter, which I herewith gladly do. (Before continuing, you might want to read what I wrote about MQTT and Mosquitto.)

Supposing you don’t want to run the Logstash and ElasticSearch combo, for whichever reasons, you could use stash53’s MQTT emitter to publish DNS queries to an MQTT broker from which you, from different vantage points in your network, handle these queries.

Assume we’ve compiled stash53 for MQTT, and are invoking it like this, specifying the address/port of the broker, and the topic on which to publish on, as dns/stash/servers/hippo:

./stash53 -e 127.0.0.1/1183 \
        -N hippo-B9 \
        -l /dev/null \
        -P 0 \
        -O dns/stash/servers/hippo

I can easily use the Mosquitto CLI utility to “follow” what the broker receives (the -v option instructs mosquitto_sub to display the received topic name):

mosquitto_sub -h hippo -v -t 'dns/#'

dns/stash/servers/hippo {"ipv6":false,"error":false,"d_addr":"192.168.1.10","s_addr":"192.168.1.130","rrprint":"example.org.\t60\tIN\tA\t192.168.1.10\n","qclass":"IN","qname":"example.org.","tld":"org","qtype":"A","answer":"192.168.1.10","ttl":60,"nsid":"hippo-B9","n":174}

stash53 publishes JSON, so that’s what we see. Beautified, it looks like this:

{
    "answer": "192.168.1.10", 
    "d_addr": "192.168.1.10", 
    "error": false, 
    "ipv6": false, 
    "n": 174, 
    "nsid": "hippo-B9", 
    "qclass": "IN", 
    "qname": "example.org.", 
    "qtype": "A", 
    "rrprint": "example.org.\t60\tIN\tA\t192.168.1.10\n", 
    "s_addr": "192.168.1.130", 
    "tld": "org", 
    "ttl": 60
}

A small Python utility (console.py) subscribes to the topic and prints out the queries as they’re published to the broker:

$ ./console.py
hippo-B9     192.168.1.130        A        example.org.
hippo-B9     2001:6f8:900:8d2e:ea39:35ff:fe20:a238 A        powerdns.com.
hippo-B9     2001:6f8:900:8d2e:ea39:35ff:fe20:a238 RRSIG    powerdns.com.
hippo-B9     192.168.1.10         DNSKEY   powerdns.com.
...

As alluded to in the diagram above, I could run any number of similar programs which did different things with the messages they subscribe to. For example:

• Log DNS queries to a flat file
• Connect to an RDBMS and store queries/responses for later searching.
• Publish to a Web page with Web sockets for “live” monitoring
• etc.

I trust this has clarified things a bit.

I do want to re-iterate that stash53 works with any brand of DNS server, whether authoritative or recursive. :-)