how to monitor/sniff local DNS lookups to the windows local DNS? (on XP, Vista, Win7)

Question

Is there a way in .NET (for a WPF application running on XP, Vista, or Windows 7) to monitor/sniff DNS lookups that the application is making to local DNS?

For example, is there a log file for a windows local DNS cache somewhere?

(Background - parsing network packets doesn't seem to work as a DNS lookup may not have to be issued outside of the PC if it is already cached in the Windows DNS)

Answer 1

FWIW, checking tcpview+perfmon /res, it appears that dnscache listens on 'localhost' (for both ipv4 and ipv6 on my win7) on UDP port 5355, and since netmon can capture localhost traffic (most sniffers can't AFAIK), you should be able to use the NMAPI (look at Microsoft Network Monitor 3\api\NetmonAPI.cs after you install it) to monitor that traffic.

• NetMon: http://www.microsoft.com/downloads/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f&displaylang=en

VRTA and NMExperts (IIRC) site on top of the managed interface if you want places to look for existing consumers for sample code:

• VRTA: http://www.microsoft.com/downloads/details.aspx?FamilyID=119f3477-dced-41e3-a0e7-d8b5cae893a3&displaylang=en
• NMExperts: http://nmexperts.codeplex.com/