DNS is not displayed in Ddospot.

[kotohueisnfiawe9]

Hi, I recently noticed that Ddospot within T-Pot does not seem to be receiving port 53 properly.
The previous server was also receiving port 53 well.
When we check if there is any access to port 53 in kibana, we can only confirm that we are receiving access to port 53.
Why is this not reflected in Ddospot?
One thing that draws me back is that when I check for open ports in "shodan", port 53 is not open (closed?). If anyone knows why, please let us know.
If anyone knows, please let me know.

[t3chn0m4g3]

Usually this means there is no log object containing the field in the index which means there is no log entry regarding udp/53. Did Ddospot log any udp/53 related connections?

[kotohueisnfiawe9]

Thank you.
I'm still a newbie and don't know if Ddospot logged udp/53 or not.
Just looking at /data/ddospot/log.I have logs like this and I think the dns-related behavior is not working correctly.

[t3chn0m4g3]

This log only shows a successful start / stop of Ddospot's DNS honeypot. It did not log anything udp/53 related and as such it is fully normal the ddospot name field is not populated (yet) in Kibana.
If you want to log UDP events your firewall / router needs to forward udp/53 to T-Pot. Make sure you really want this as traffic might be very high exhausting the resources.

[kotohueisnfiawe9]

Thank you.
When I was using RaspberryPi, I was able to observe DNS with DDoSpot; after I changed my PC, I couldn't observe DNS anymore and was wondering why. As you can see in the figure, accesses are coming to port 53 of T-Pot. Does this mean that T-Pot is receiving 53/udp but DDoSpot is not receiving it properly?
We are aware that traffic may exhaust resources. However, I would honestly like to make an observation at that time.