| 1 |
<module> |
|---|
| 2 |
<name>dns</name> |
|---|
| 3 |
<description><para>The dns module leverages libudns to allow highly concurrent DNS lookups of a variety of DNS RR types. In the event that you name a dns check <parameter>in-addr.arpa</parameter> with an rtype of <parameter>PTR</parameter>, the result of the query may be used throughout reconnoiter as the identifying hostname of that target.</para> |
|---|
| 4 |
<para>This module provides the <function>inaddrarpa</function> interpolation method which will reverse a dot-delimited IP address. This is particularly useful for constructing in-addr.arpa queries, but also used for checking blacklists, whitelists and other IP-based DNS databases.</para> |
|---|
| 5 |
</description> |
|---|
| 6 |
<loader>C</loader> |
|---|
| 7 |
<image>dns.so</image> |
|---|
| 8 |
<moduleconfig /> |
|---|
| 9 |
<checkconfig> |
|---|
| 10 |
<parameter name="nameserver" |
|---|
| 11 |
required="optional" |
|---|
| 12 |
default="%[target] or determined from underlying system" |
|---|
| 13 |
allowed=".+">The domain name server to query. If the name of the check is in-addr.arpa, the system default nameserver is used. Otherwise, the nameserver is the %[target] of the the check.</parameter> |
|---|
| 14 |
<parameter name="ctype" |
|---|
| 15 |
required="optional" |
|---|
| 16 |
default="IN" |
|---|
| 17 |
allowed="(IN|CH|HS)">The DNS class of the query. IN: Internet, CH: Chaos, HS: Hesoid.</parameter> |
|---|
| 18 |
<parameter name="rtype" |
|---|
| 19 |
required="optional" |
|---|
| 20 |
default="A|PTR" |
|---|
| 21 |
allowed="(A|AAAA|TXT|MX|SOA|CNAME|PTR|NS|MB|MD|MF|MG|MR)">The DNS resource record type of the query. If the name of the check is in-addr.arpa, the default is PTR, otherwise it is A.</parameter> |
|---|
| 22 |
<parameter name="query" |
|---|
| 23 |
required="required" |
|---|
| 24 |
default="%[name]|%[:inaddrarpa:target].in-addr.arpa" |
|---|
| 25 |
allowed=".+">The query to send. If the name of the check is in-addr.arpa, the reverse IP octet notation of in-addr.arpa syntax is synthesized by default. Otherwise the default query is the name of the check itself.</parameter> |
|---|
| 26 |
</checkconfig> |
|---|
| 27 |
<examples> |
|---|
| 28 |
<example> |
|---|
| 29 |
<title>Establishing PTR records for hosts.</title> |
|---|
| 30 |
<para>The following established names for targets 10.1.2.{3,4,5,6} using the local nameserver (10.1.2.2) that provides service for that network.</para> |
|---|
| 31 |
<programlisting><![CDATA[ |
|---|
| 32 |
<noit> |
|---|
| 33 |
<modules> |
|---|
| 34 |
<module image="dns" name="dns"/> |
|---|
| 35 |
</modules> |
|---|
| 36 |
<checks> |
|---|
| 37 |
<config> |
|---|
| 38 |
<nameserver>10.1.2.2</nameserver> |
|---|
| 39 |
</config> |
|---|
| 40 |
<ptr module="dns" name="in-addr.arpa"> |
|---|
| 41 |
<check uuid="2cddb2a8-76ff-11dd-83c8-f75cb8b93bd9" target="10.1.2.3"/> |
|---|
| 42 |
<check uuid="2dd79110-76ff-11dd-9b54-739adc274a93" target="10.1.2.4"/> |
|---|
| 43 |
<check uuid="5627560a-76ff-11dd-941f-4b75679cb908" target="10.1.2.5"/> |
|---|
| 44 |
<check uuid="5fdcb8de-76ff-11dd-ae16-2740afc178ae" target="10.1.2.6"/> |
|---|
| 45 |
</ptr> |
|---|
| 46 |
</checks> |
|---|
| 47 |
</noit> |
|---|
| 48 |
]]></programlisting> |
|---|
| 49 |
</example> |
|---|
| 50 |
<example> |
|---|
| 51 |
<title>Checking labs.omniti.com.</title> |
|---|
| 52 |
<para>The following checks the DNS server residing at 66.225.209.4 for the A record of labs.omniti.com.</para> |
|---|
| 53 |
<programlisting><![CDATA[ |
|---|
| 54 |
<noit> |
|---|
| 55 |
<modules> |
|---|
| 56 |
<module image="dns" name="dns"/> |
|---|
| 57 |
</modules> |
|---|
| 58 |
<checks> |
|---|
| 59 |
<ns1 module="dns" target="66.225.209.4"> |
|---|
| 60 |
<check uuid="3cddb2a8-76ff-11dd-83c8-f75cb8b93bd9" name="labs.omniti.com"/> |
|---|
| 61 |
</ns1> |
|---|
| 62 |
</checks> |
|---|
| 63 |
</noit> |
|---|
| 64 |
]]></programlisting> |
|---|
| 65 |
</example> |
|---|
| 66 |
</examples> |
|---|
| 67 |
</module> |
|---|
