How do I view traffic passing through an Amazon Route 53 resolver outbound endpoint?
I want to view traffic passing through Amazon Route 53 resolver outbound endpoint. How can I do this?
"I want to view traffic passing through Amazon Route 53 resolver outbound endpoint. How can I do this?Short descriptionTo view traffic passing through Route 53 resolver endpoints, configureAmazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring.ResolutionConfigure network connectivityConfirm the target EC2 instance's security group and network access control list (network ACL) allow incoming traffic on UDP port 4789 from the outbound endpoint elastic network interface.Confirm the target EC2 instance has connectivity to the outbound endpoint's network interface subnet.Confirm the outbound endpoint network interface subset is configured for outgoing traffic for the EC2 instance on UPD port 4789. The subset configuration includes network ACL, security groups, and routing tables.Set up Amazon VPC Traffic Mirroring1.    Create a traffic mirror target using the network interface of the EC2 instance you're using as the target.2.    Create a mirror filter to identify the DNS traffic from the outbound endpoint network interface to the EC2 mirror target.Example mirror filter for Route 53Note: The example values in this table represent the following:VPC A is associated with Route 53 resolve rule to forward *.test.com domain DNS queries to on-premise networkOn-premise network is hosting domain *.test.comValueInbound RuleOutbound RuleRule numberRule priorityRule priorityRule ActionAcceptAcceptProtocolUDP and TCPUDP and TCPSource port range531024-65535Destination port range1024-6553553Source CIDR blockOn-premise CIDRVPC A CIDRDestination CIDR blockVPC A CIDROn-premise CIDR3.    Create a mirror session for each outbound endpoint network interface to the mirror EC2 instance. Use the following values:            Mirror source: outbound endpoint network interfaceMirror target: traffic mirror that you created previouslySession number: 1Filter: mirror filter that you created previouslyView mirrored trafficFor Linux operating systems1.    View the captured traffic logs by running the following command:sudo tcpdump -w <filename>.pcap -i <eth> port 4789For filename, use the filename where you want to store the captured traffic logs. For eth, use the ethernet port that you want to use on your EC2 instance. 2.    Transfer the file from the EC2 instance to your local computer by running the following command:scp -i <keypair>.pem ec2-user@<ec2 instance's public/private DNS name or IP address>:<file path>/<filename>.pcap ~/Desktop/For keypair, use the keypair you used to log into the instance. For filename, use the filename where you want to store the captured traffic logs.3.    Open the capture file to view the DNS packets.For windows operating systems1.    Open the Wireshark tool.2.    Filter traffic using the IP address of the outbound resolver endpoint.3.    Open the capture file to view the DNS packets.Related informationResolving Domain Name System (DNS) queries between VPCs and your networkFollow"