FreeBSD dnstop: Monitor and Display DNS Server Traffic On Your Network

by on February 13, 2008 · 0 comments· LAST UPDATED July 31, 2008

in , ,

Q. How do I monitor my BIND dns server traffic om my network under FreeBSD operating systems?

A. You can displays various tables of DNS traffic on your network using dnstop. dnstop is a small tool to listen on device or to parse the file savefile and collect and print statistics on the local network's DNS traffic. You must have read access to /dev/bpf*.

Install dnstop under FreeBSD

Type the following commands
# portsnap fetch update
# cd /usr/ports/dns/dnstop/
# make install clean

How do I monitor DNS server stats in real time?

Simply type the dnstop as follows:
# dnstop {interface-name}
# dnstop em0
# dnstop fxp0

(Fig.01: dnstop in action)

(Fig.01: dnstop in action)


To exit the program press ^X (CTRL + X). To reset the counters hit CTRL+R. You can try following keys to view diffrent data while running dnstop:

  • s : display the source address table
  • d : display the destination address table
  • t : display the breakdown of query types seen
  • o : display the breakdown of opcodes seen

For further information read dnstop man page:
$ man dnstop

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 0 comments… add one now }

Leave a Comment

Tagged as: , , , , , , , , , ,

Previous Faq:

Next Faq: