topic Re: Filter by DNS query the DNS requests in Firewall and Security Management

Filter by DNS query the DNS requests

CarlosDias — Thu, 29 Aug 2024 13:54:44 GMT

Hi,

On the security logs on the Manager, how can I filter on DNS requests, the logs that have a specific DNS_query without opening line by line and see the DNS_query field ?

Regards

Re: Filter by DNS query the DNS requests

AkosBakos — Thu, 29 Aug 2024 16:09:59 GMT

Hi @CarlosDias

You mean that, you want to search among the logs for eg.: nasa.org?

Akos

Re: Filter by DNS query the DNS requests

AkosBakos — Thu, 29 Aug 2024 16:29:42 GMT

Hi @CarlosDias

I checked in a working cluster. Here, the APPL and URLF blade are switched on.

When I type a simple URL, the relevant results are shown in the log.

Akos

Re: Filter by DNS query the DNS requests

the_rock — Thu, 29 Aug 2024 16:33:51 GMT

Same here, works in my R81.20 and R82 lab.

Andy

Re: Filter by DNS query the DNS requests

CarlosDias — Fri, 30 Aug 2024 08:40:27 GMT

Hi,

No that is not what I mean. That way I can find traffic that goes to a specific url or domain.

What I want is on a DNS packet sent to the DNS server I could filter the DNS_query field.

If you open a DNS packet log on the checkpoint you can see a field called DNS_query, where you can see what url it is asking to the DNS server. I am not able to filter that. The only solution is to open this dns traffic logs, one by one.

Regards

Re: Filter by DNS query the DNS requests

Lesley — Fri, 30 Aug 2024 10:44:32 GMT

Btw is the version you still run is supported? I don't recall it is possible to see this in supported versions

Re: Filter by DNS query the DNS requests

CarlosDias — Fri, 30 Aug 2024 10:46:51 GMT

Hi,

I am running R81.10, which I thinks its still supported.

Regards

Re: Filter by DNS query the DNS requests

AkosBakos — Fri, 30 Aug 2024 11:15:27 GMT

Hi @CarlosDias

If its field is not indexed, you can'T search for it with regular expression.

What is the most painful for me, the NAT field is te same.

Akos

Re: Filter by DNS query the DNS requests

PA — Wed, 18 Mar 2026 07:46:34 GMT

Hello,

I have version R82. How can I make the "dns_query" field appear in the domain-udp query logs? I tried the solutions from sk116694 and sk183647 without success, but it works in R81.20.

Re: Filter by DNS query the DNS requests

PA — Wed, 18 Mar 2026 08:41:47 GMT

Hi,

I have version R82. How can I make the "dns_query" field appear in the domain-udp query logs? I tried the solutions from sk116694 and sk183647 without success, but it works in R81.20.