Decode DNS Requests with PHP

decode_dns.php

<?php

// Let's define some important variables!
$logfile = "/var/log/dns_logger";
$gateway = "10.1.1.40";
$date_format = "n/j/Y H:i:s";

// We are now going to start a UDP Socket Server
// This is going to listen on port 53, DNS
$socket = stream_socket_server("udp://$gateway:53", $errno, $errstr, STREAM_SERVER_BIND);

// If we could not bind successfully, let's throw an error
if(!$socket){
    die($errstr);

}else{
    // Do/While is used to loop through the socket
    // We essentially daemonized it.
    do{
        // When it comes to UDP, we need to use stream_socket_recvfrom.
        // RFC 2671 - 2.3. DNS Messages are limited to 512 octets in size when sent over UDP.
        $pkt = stream_socket_recvfrom($socket, 512, 0, $peer);

        // We are going to strip the first 13 and last 18 bits from packet
        // and unpack with to unsigned Char. The * means repeat for rest of string.
        $pkt = unpack("C*", substr($pkt,13, strlen($pkt)-18));
        $o = '';

        // Now lets loop through the pkt and translate the response to human readable ASCII
        foreach($pkt as $s){
            // If it's less than 32, it's assumed to be a period
            if($s < 32)
                $o .= ".";
            // If its more than 32 less than 127, it's seen as a regular character
            elseif($s > 32 && $s < 127)
                $o .= chr($s);
            else
                continue;
        }

        // Lets append the log entry with a Date and Time and log it
        $line = date($date_format)." :: Request for: ";
        file_put_contents($logfile, $line.$o."n", FILE_APPEND);
    }while($pkt !== false);
}