View DNS Queries/Logs

[sweetlyham]

Thank you for stopping by and taking the time I will give you a brief explination of what I would like to achieve: I am needing to view the DNS queries that are hitting my router or are picked up by the DNS Filter I have enabled.

I am receiving strange queries on my AdGuard Home and I am trying to pinpoint where they are coming from however in this instance it is originating from the router so it is likely the DNS Filter hijacking a request.

I have tried altering the dnsmasq.conf file by adding the log-queries command (using vi in SSH) but nothing is showing up (restarted after saving) in the system log page on the browser despite AdGuard Home showing queries coming through from my router.

 

[RMerlin]

log-queries will show queries received by the router, not queries sent by the router.

 

[sweetlyham]

log-queries will show queries received by the router, not queries sent by the router.

In that case how can I see requests hijacked by DNS Filter?

 

[RMerlin]

In that case how can I see requests hijacked by DNS Filter?

You would need to run tcpdump on the router and monitor traffic on outbound port 53. The query never reaches dnsmasq on the router as the connection attempt is DNAT'ed by the firewall to your destination server.

 

[sweetlyham]

You would need to run tcpdump on the router and monitor traffic on outbound port 53. The query never reaches dnsmasq on the router as the connection attempt is DNAT'ed by the firewall to your destination server.

I have tried as per your advice and it is showing as coming from the router address, how would I in tcpdump view it hitting the router before it is sent to the specified DNS server?

 

[sweetlyham]

All good I figured it out thank you for your help it's greatly appreciated and I appreciate your work.