DNS traffic

[pfe]

Hello everyone !

Please could you explain to me how can I use Packetbeat to monitor DNS traffic

Thank you
Ragards

[andrewkroh]

DNS capturing is enabled in the default configuration file. So just follow the Getting Started Guide for Packetbeat and you should be up and running.

[pfe]

ok thank you for your response, but from where can I capture the traffic and analyze it ?

[andrewkroh]

Packetbeat listens to the traffic on any one of the computer's network interfaces. So you install it on a server you will only see traffic to and from that server. If you want to see traffic from multiple devices on a network, then a common solution is to configure a port mirror on one of your managed switches or deploy a network tap device and feed that traffic to a free NIC on the server running Packetbeat.