Monitor DNS and SNI
Wireshark
tls.record.content_type==22
DNS Monitor
# IMPORTANT: This script was created used ChatGPT. Use at your own risk.
from scapy.all import sniff
from scapy.layers.dns import DNS, DNSQR
from datetime import datetime
LOG_FILE = "dns_log.txt"
# Optional: domains you want highlighted
BLOCKLIST = [
"adult",
"porn",
"gambling",
"casino",
]
seen = set()
def process_packet(packet):
if packet.haslayer(DNSQR):
try:
domain = packet[DNSQR].qname.decode("utf-8").rstrip(".")
# Avoid duplicate spam
now_minute = datetime.now().strftime("%Y-%m-%d %H:%M")
unique_key = f"{now_minute}:{domain}"
if unique_key in seen:
return
seen.add(unique_key)
timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
warning = ""
for word in BLOCKLIST:
if word.lower() in domain.lower():
warning = " [POTENTIALLY INAPPROPRIATE]"
break
log_entry = f"[{timestamp}] {domain}{warning}"
# Print to screen
print(log_entry)
# Save to file
with open(LOG_FILE, "a", encoding="utf-8") as f:
f.write(log_entry + "\n")
except Exception as e:
print(f"Error processing packet: {e}")
print("DNS monitor started...")
print(f"Logging to: {LOG_FILE}")
print("Press CTRL+C to stop.\n")
# Sniff DNS traffic (UDP port 53)
sniff(filter="udp port 53", prn=process_packet, store=False)
SNI Monitor
# IMPORTANT: This script was created used ChatGPT. Use at your own risk.
from scapy.all import sniff, TCP, Raw
from datetime import datetime
LOG_FILE = "sni_log.txt"
def extract_sni(payload):
try:
data = bytes(payload)
# TLS Handshake check
if len(data) < 5:
return None
# TLS Handshake record
if data[0] != 0x16:
return None
pos = 43
# Session ID
session_id_length = data[pos]
pos += 1 + session_id_length
# Cipher Suites
cipher_suites_length = int.from_bytes(data[pos:pos+2], 'big')
pos += 2 + cipher_suites_length
# Compression Methods
compression_methods_length = data[pos]
pos += 1 + compression_methods_length
# Extensions
extensions_length = int.from_bytes(data[pos:pos+2], 'big')
pos += 2
end = pos + extensions_length
while pos + 4 <= end:
ext_type = int.from_bytes(data[pos:pos+2], 'big')
ext_length = int.from_bytes(data[pos+2:pos+4], 'big')
pos += 4
# SNI Extension
if ext_type == 0x0000:
sni_data = data[pos:pos+ext_length]
# Skip list length + name type
server_name_length = int.from_bytes(sni_data[3:5], 'big')
server_name = sni_data[5:5+server_name_length]
return server_name.decode(errors="ignore")
pos += ext_length
except Exception:
return None
return None
def packet_callback(packet):
if packet.haslayer(TCP) and packet.haslayer(Raw):
payload = packet[Raw].load
sni = extract_sni(payload)
if sni:
timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
line = f"[{timestamp}] {sni}"
print(line)
with open(LOG_FILE, "a") as f:
f.write(line + "\n")
print("Listening for TLS SNI traffic...")
sniff(filter="tcp port 443", prn=packet_callback, store=False)
