Maximum number of concurrent DNS queries reached?

Not so elegant but it should do the job. Paste the following into /etc/firewall.user, changing the network if necessary.

NET="192.168.1."
iptables -N DNSCOUNTER
iptables -I INPUT -m udp -p udp --dport 53 -j DNSCOUNTER
IP=2
while [ $IP -le 254 ]
do
iptables -A DNSCOUNTER -s $NET$IP -j RETURN
let "IP+=1"
done

After restarting the firewall, it will create a chain that will count the DNS traffic, originating from each lan IP address.

Sort the results by the number of packets.

iptables -nvL DNSCOUNTER | sort -nr
1 Like