RADNS(1)

RADNS(1) 💖

okay bestie, welcome to the General Commands Manual page for radns — she's part of the argus client fam and she's literally so useful, no cap. pull up a chair, grab a boba, and let's get into it 🧋✨

✨ NAME ✨

radns — process DNS data from argus(8) data streams / files.

🌸 SYNOPSIS 🌸

radns [raoptions] [-- filter-expression]

🦋 DESCRIPTION 🦋

So here's the vibe: radns reads argus data from an argus-data source, and then it extracts and tracks DNS transaction data out of the argus data records. She's a flow record labeler, okay? Which means you can configure her to label flow records with the dns names of the saddr and daddr addresses seen in the outer IP DSR of flow records. 💅

And because of all that, radns can be a whole stage in an argus data flow stream, enhancing real-time flow records with DNS metadata. it's giving pipeline icon. periodt. 🔥

👑 OPTIONS 👑

radns, like literally all ra based clients, supports a bunch of ra options — including filtering of input argus records through a terminating filter expression, and the ability to specify the output style, format and contents for printing data. head over to ra(1) for a complete description of ra options, bestie. the options that are specifically radns(1)'s thing are:

• -M modes — the supported modes are:
  • json — print the DNS transaction data in json format. 🎀

🎀 CONFIGURATION 🎀

radns(1) can be configured using a radns.conf(5) configuration file. go read radns.conf(5) for a complete description of radns configuration options, okay? i'm not gatekeeping, the docs are right there. 🫶

🌈 INVOCATION 🌈

okay so here's a sample invocation of radns(1). this call reads argus(8) data from inputfile and prints the DNS transaction content as it is read from the argus(8) data. 🌟

% radns -R /usr/local/argus/archive/*/en0/2024/02/05/*.05.10.0* -N 1200
02/05.05:12:50.506561: AAAA? KitAppTV.local. :
02/05.05:14:30.116963: AAAA? qosient.mail.pairserver.com. :  SOA pairserver.com. ns1.pair.com. root.pair.com. 2024020506 3600 300 604800 7200
02/05.10:01:06.404054: PTR? lb._dns-sd._udp.0.129.37.10.in-addr.arpa. :  SOA 10.in-addr.arpa. prisoner.iana.org. hostmaster.root-servers.org. 1 604800 60 604800 604800
apophis:argus-clients-5.0 carter$ bin/radns -M json -R /usr/local/argus/archive/*/en0/2024/02/05/*.05.10.0* -N 1250
02/05.05:12:50.506561: AAAA? KitAppTV.local. :
02/05.05:14:30.116963: AAAA? qosient.mail.pairserver.com. :  SOA pairserver.com. ns1.pair.com. root.pair.com. 2024020506 3600 300 604800 7200
02/05.10:01:06.404054: PTR? lb._dns-sd._udp.0.129.37.10.in-addr.arpa. :  SOA 10.in-addr.arpa. prisoner.iana.org. hostmaster.root-servers.org. 1 604800 60 604800 604800
02/05.10:01:45.717174: Type65? init.push.apple.com. :  CNAME init.push.apple.com. init.push-apple.com.akadns.net. SOA akadns.net. internal.akadns.net. hostmaster.akamai.com. 1629813934 90000 90000 90000 180
02/05.10:01:45.717302: AAAA? init.push.apple.com. :  AAAA init.push-apple.com.akadns.net. 2620:149:208:430a::4[28],2620:149:208:430e::4[28],2620:149:208:430c::4[28],2620:149:208:430b::4[28],2620:149:208:430d::4[28] CNAME init.push.apple.com. init.push-apple.com.akadns.net.
02/05.10:01:45.717432: A? init.push.apple.com. :  A init.push-apple.com.akadns.net. 17.188.179.2[16],17.188.178.2[16],17.188.178.226[16],17.188.178.34[16],17.188.143.158[16],17.188.143.157[16],17.188.179.34[16],17.188.143.187[16] CNAME init.push.apple.com. init.push-apple.com.akadns.net.
02/05.10:01:45.736437: Type65? init.push-apple.com.akadns.net. :  SOA akadns.net. internal.akadns.net. hostmaster.akamai.com. 1629813934 90000 90000 90000 180

and here's another sample invocation of radns(1) 💜 — this call reads argus(8) data from inputfile and uses the -q option to suppress DNS transaction reporting. radns(1) caches its DNS server, clients and transaction data in memory, and when it's finished reading data, it resolves queries about the data.

in this example, she reads a days of data and looks up references to a specific DNS query, printing its output as json data. ⭐

% radns -M json -R /usr/local/argus/archive/*/en0/2024/02/05 -qM search:qosient.com.
{ "name":"qosient.com.", "ref":"3", "stime":"1707147521","ltime":"1707183149", "addr":[ "216.92.14.146" ], "server":[ "2603:7000:c00:b053:ea9f:80ff:fe85:5cc5" ], "client":[ "2603:7000:c00:b053:987f:ad32:81c:e70f", "2603:7000:c00:b053:f9f2:6d70:ff9c:48d7" ] }

💜 COPYRIGHT 💜

Copyright (c) 2000-2024 QoSient. All rights reserved. 🫡 (yes ma'am, all of them, respect the legacy)

💖 SEE ALSO 💖

radns.conf(5), ra(1), rarc(5), argus(8)

🍓 FILES 🍓

(the original page lists this section heading with no entries under it, bestie — so there's literally nothing to report here, and that's on period.) 💀

🧚 AUTHORS 🧚

Carter Bullard (carter@qosient.com). 👑

🙈 BUGS 🙈

(no bugs listed on the page itself — which is either iconic or deeply suspicious, and honestly? both. 😭)

and that's the whole page, bestie!! 🌸 this was radns version 5.0.3, dated 07 October 2023, straight from the RADNS(1) manual. now go label some flows and slay 💅✨🦋