Skip to content
GoNetSim
Menu
DocsAboutDownloadsContact
Guides
InstallationUsageConfigurationDocker
Scripting
Getting StartedLua APIExamples
Reference
DNSHTTPHTTPSListenersTLS

DNS

Reference sheet for the DNS service

The DNS service simulates a DNS server, currently supporting A, AAAA, CNAME, TXT, NS, SRV, PTR, MX, SOA & CAA, and a generic response for any other record types. The returned IPv4, IPv6, domain name (for CNAME, MX & NS) and TXT values can all be separately configured.

The service answers every requested domain: malware frequently targets random or hardcoded names, so any lookup gets a sinkhole response pointing back at GoNetSim. Combined with the HTTP & HTTPS services, this makes a powerful monitor for attempted C2 connections & covers most of the simulation needs for basic malware analysis.

Configuration

Section titled “Configuration”
Option Type Default Description
enabled bool true Whether the DNS service is enabled
listen string :53 The address and port to listen on (e.g. :53)
network string udp The network protocol to use (e.g. udp, tcp)
ipv4 string auto The IP address to return for A records; auto detects this machine’s IPv4 address (falling back to 127.0.0.1)
ipv6 string ::1 The IP address to return for AAAA records
domain string localhost The domain name to return for CNAME, MX & NS records
txt string TXT record response from GoNetSim The text to return for TXT records
ttl int 60 The TTL (time to live) value to return for all records, in seconds
compress bool false Whether to enable DNS message compression

To see instructions on how to configure these options, see the configuration guide.

Command

Section titled “Command”

The DNS service can be run on its own by passing it as a target to run:

Terminal window
gonetsim run dns

This starts the DNS service with the current configuration, without starting any other services.

Testing

Section titled “Testing”

You can test the DNS service using dig.

  1. Start the DNS service

    Terminal window
    gonetsim run dns

  2. In another terminal, run the following command to query for an A record:

    Terminal window
    dig @localhost -p 53 example.com A

    You should see a response with the IP address you configured for A records (default: 127.0.0.1)

  3. Return to the GoNetSim instance and you should see a log of the query in the output

Further reading

Section titled “Further reading”