Dnsmasq

LogZilla App Store application: Dnsmasq

Overview

dnsmasq is a lightweight Linux daemon that provides DNS, DHCP, and TFTP services. The LogZilla dnsmasq app focuses specifically on parsing DHCP server operations to extract IP address assignments and hostname information.

App Function

The dnsmasq app parses assigned IP addresses and hostnames from DHCP assignment (DHCPACK) messages, creating user tags for network asset tracking and correlation.

Vendor Documentation

Log Source Details

ItemValue
VendorLinux distributions
Device TypeLinux OS
Supported Software Version(s)all
Collection MethodSyslog
Configurable Log Output?no
Log Source Typelinux syslog
ExceptionsN/A

Incoming Log Format

dnsmasq uses standard Linux syslog format. DHCP messages contain space-separated fields in the following order:

  1. DHCP operation - Type of DHCP transaction (e.g., DHCPACK)
  2. Network interface - Interface name in parentheses
  3. IP address - Assigned IPv4 address
  4. MAC address - Client hardware address
  5. Hostname - Client hostname (if provided)

Parsed Metadata Fields

The dnsmasq app extracts the following information from DHCP assignment messages:

Message Format:

text
DHCPACK(<interface>) <IP address> <MAC address> <hostname>

Generated User Tags:

Tag NameExample ValueDescription
DNSmasq DHCP Assigned IP192.168.254.101IP address assigned to the client
DNSmasq DHCP Assigned HostnamedhcpnineHostname assigned to the client
DNSmasq DHCP IP -> Hostname192.168.254.101 -> dhcpnineCombined IP to hostname mapping

Log Examples

DHCP IP Address Assignment

text
DHCPACK(enp0s3) 192.168.254.101 08:00:55:66:77:88 dhcpnine
Dnsmasq | LogZilla Documentation