problem with catching DNS udp packets

Hi,
I write a simple program to catch DNS UDP packets which is listening to port 53.

UdpClient server = null;
            try
            {
                server = new UdpClient(0);//also I tried port 53 but same result

            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }

            IPEndPoint remoteip = new IPEndPoint(IPAddress.Any, 0);
            for (; ; )
            {

                byte[] bb = server.Receive(ref remoteip);
                Console.WriteLine(Encoding.ASCII.GetString(bb));

            }

but it is not showing anything ,to be honest it will stuck in the following line :

                byte[] bb = server.Receive(ref remoteip);

my purpose is to catch my local computer DNS request which are made by several program on my pc then relay their request to real dns servers and then after that cache their relative addresses for later on.
that's why I thought it should be good idea first of all to test DNS:udp53 but no chance.

Hi I'm trying to do something similar and in the process of doing some research I happened across your question and thought, just in case you were still looking for an answer, I might give you a few tips on what I've learned so far. First of all, packets are leaving your computer and going to the DNS server. So you can't catch them by listening because they are not going your way, but out and away from you. What you really want is a packet sniffer that listens to all traffic on your computer (both incoming and outgoing). It took some time but I did get one created using the code found at http://www.digigrupp.com/sniffer/main.cs.aspx but I'm not 100% sure if it is catching everything or just what it is catching - still learning. You might find one already created by someone else but where is the fun in that? Second option is to tamper with the DNS IP addresses on another computer. Setting the 2 DNS IP addresses to 1.0.0.0 and 1.0.0.1 will prevent the computer from finding the DNS server. Changing one of these IPs to match your computer's IP will cause that computer to try to talk to your computer. Your program should then be able to catch the DNS question being asked by the other computer. In theory you could then send the packet on to the DNS server, receive an answer back from the DNS server and then forward that answer back on to the other computer. You will need the DNS server's IP and I found some code on the web that uses System.Net.NetworkInformation to access NetworkInterface.GetAllNetworkInterfaces(). It then accesses each interface with .GetIPProperties().DnsAddresses to get the DNS IPs. Third option, if you don't have a second computer, is to try VirtualBox and run an OS in VirtualBox. Then tamper with the DNS IPs in that virtual computer and redirect them to your computer. From there you do things the same as listed in the second option above. This can be a lot of work and it really should be done on a high end PC because you will be bored to tears waiting for the virtual PC to load if your computer isn't powerful enough (P4 3.6 GHz is as low as I would go and you can't have Outlook up checking email while using it). Forth possibility is to use the registry commands available in dot-net to modify the registry on your computer so the DNS points to the IP of your computer. In theory this will cause your computer to send out the DNS request only to receive them again. Again your program can then catch the request and process them. I can tell you where the registry is but you will have to do some testing and experimenting to see if it works. You should be able to find the Globally Unique Identifiers (GUIDs) that are assigned to the NICs in the key "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters" and then find those same GUIDs keys in the "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" key. Once you find the proper GUID then change the "NameServer" value to a REG_SZ containing the text "1.0.0.0,1.0.0.1" where "1.0.0.0" and/or "1.0.0.1" need to be changed to your computer's IP. When the program is done then it must restore "NameServer" back to its original state. NOTE: FAILURE TO RESTORE NameServer VALUE WILL PREVENT YOUR COMPUTER FROM USING DNS! For the most part killing your computer's ability to use the Internet. You will have to decide what route looks best to you.

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Darin17y ago
Hi I'm trying to do something similar and in the process of doing some research I happened across your question and thought, just in case you were still looking for an answer, I might give you a few tips on what I've learned so far. First of all, packets are leaving your computer and going to the DNS server. So you can't catch them by listening because they are not going your way, but out and away from you. What you really want is a packet sniffer that listens to all traffic on your computer (both incoming and outgoing). It took some time but I did get one created using the code found at http://www.digigrupp.com/sniffer/main.cs.aspx but I'm not 100% sure if it is catching everything or just what it is catching - still learning. You might find one already created by someone else but where is the fun in that? Second option is to tamper with the DNS IP addresses on another computer. Setting the 2 DNS IP addresses to 1.0.0.0 and 1.0.0.1 will prevent the computer from finding the DNS server. Changing one of these IPs to match your computer's IP will cause that computer to try to talk to your computer. Your program should then be able to catch the DNS question being asked by the other computer. In theory you could then send the packet on to the DNS server, receive an answer back from the DNS server and then forward that answer back on to the other computer. You will need the DNS server's IP and I found some code on the web that uses System.Net.NetworkInformation to access NetworkInterface.GetAllNetworkInterfaces(). It then accesses each interface with .GetIPProperties().DnsAddresses to get the DNS IPs. Third option, if you don't have a second computer, is to try VirtualBox and run an OS in VirtualBox. Then tamper with the DNS IPs in that virtual computer and redirect them to your computer. From there you do things the same as listed in the second option above. This can be a lot of work and it really should be done on a high end PC because you will be bored to tears waiting for the virtual PC to load if your computer isn't powerful enough (P4 3.6 GHz is as low as I would go and you can't have Outlook up checking email while using it). Forth possibility is to use the registry commands available in dot-net to modify the registry on your computer so the DNS points to the IP of your computer. In theory this will cause your computer to send out the DNS request only to receive them again. Again your program can then catch the request and process them. I can tell you where the registry is but you will have to do some testing and experimenting to see if it works. You should be able to find the Globally Unique Identifiers (GUIDs) that are assigned to the NICs in the key "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters" and then find those same GUIDs keys in the "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" key. Once you find the proper GUID then change the "NameServer" value to a REG_SZ containing the text "1.0.0.0,1.0.0.1" where "1.0.0.0" and/or "1.0.0.1" need to be changed to your computer's IP. When the program is done then it must restore "NameServer" back to its original state. NOTE: FAILURE TO RESTORE NameServer VALUE WILL PREVENT YOUR COMPUTER FROM USING DNS! For the most part killing your computer's ability to use the Internet. You will have to decide what route looks best to you.