Categories

Sguil Client Reverse DNS Causes Client To Freeze?

If you have ever tried to use the Sguil client’s reverse DNS under the IP Resoluation tab and noticed that it caused the application to be unresponsive, here is the reason why. Tcl uses TCP for DNS by default. So if your DNS server does not allow TCP DNS, the client just sits there endlessly attempting to create the TCP socket connection everytime it tries to do a gehostbyaddress(). You can review the configuration by doing the following inside of tclsh:

# tclsh
% package require dns
1.3.2
% dns::configure
-loglevel warn -nameserver 192.168.1.1 -port 53 -protocol tcp -search {} -timeout 30000

If you want the client to do UDP DNS queries, you have to ensure you have the tcludp package installed. With Ubuntu, the package is named libudp-tcl. So the following should get you Ubuntu guys where you need to go:

# apt-get install libudp-tcl
# tclsh
% package require dns
1.3.2
% dns::configure
-loglevel warn -nameserver 192.168.1.1 -port 53 -protocol udp -search {} -timeout 30000

Or, alternatively, you can always just open up 53/TCP on your DNS server.

Leave a Reply

 

 

 

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>