|
| 1 | +<# |
| 2 | +.SYNOPSIS |
| 3 | +This script inspects and displays the Windows DNS client cache entries using either |
| 4 | +`Get-DnsClientCache` (preferred) or by parsing the output of `ipconfig /displaydns` (fallback). |
| 5 | +
|
| 6 | +.DESCRIPTION |
| 7 | +The script queries the local DNS client cache to show cached domain entries, record types, |
| 8 | +record data, and TTL values. If the PowerShell cmdlet `Get-DnsClientCache` is unavailable, |
| 9 | +the script falls back to parsing the `ipconfig /displaydns` output. |
| 10 | +
|
| 11 | +The script supports filtering cache entries based on a target string provided |
| 12 | +through the environment variable `DNS_TARGET`. |
| 13 | +If no environment variable is set, it defaults to `*` (all entries). |
| 14 | +
|
| 15 | +.EXAMPLE |
| 16 | + DNS_TARGET=*.microsoft.com |
| 17 | +
|
| 18 | +.NOTE |
| 19 | + Author: SAN |
| 20 | + Date: 01.10.25 |
| 21 | + #Public |
| 22 | +
|
| 23 | +.CHANGELOG |
| 24 | +
|
| 25 | +#> |
| 26 | + |
| 27 | +# Get filter target from environment variable |
| 28 | +$Filter = $env:DNS_TARGET |
| 29 | +if ([string]::IsNullOrWhiteSpace($Filter)) { |
| 30 | + $Filter = '*' |
| 31 | +} |
| 32 | + |
| 33 | +Write-Host '' |
| 34 | +Write-Host '--- Windows DNS Cache Inspector ---' |
| 35 | +Write-Host 'Target filter:' $Filter |
| 36 | +Write-Host '' |
| 37 | + |
| 38 | +# Try Get-DnsClientCache first |
| 39 | +try { |
| 40 | + $results = Get-DnsClientCache -ErrorAction Stop | Where-Object { |
| 41 | + ($_.Name -like $Filter) -or ($_.RecordData -like $Filter) -or ($_.RecordType -like $Filter) |
| 42 | + } | Select-Object Name, Entry, RecordType, RecordData, |
| 43 | + @{Name='TTL';Expression={$_.TimeToLive}}, |
| 44 | + Section, Status |
| 45 | +} catch { |
| 46 | + $results = @() |
| 47 | +} |
| 48 | + |
| 49 | +# Fallback to ipconfig /displaydns |
| 50 | +if (-not $results -or $results.Count -eq 0) { |
| 51 | + Write-Host 'No results from Get-DnsClientCache, falling back to ipconfig parsing...' |
| 52 | + |
| 53 | + $raw = ipconfig /displaydns 2>&1 |
| 54 | + $blocks = -split ($raw -join "`n"), "`n`r?`n" |
| 55 | + |
| 56 | + $results = @() |
| 57 | + foreach ($b in $blocks) { |
| 58 | + $lines = $b -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' } |
| 59 | + if ($lines.Count -eq 0) { continue } |
| 60 | + |
| 61 | + $entry = [PSCustomObject]@{ |
| 62 | + Name = $null |
| 63 | + RecordType = $null |
| 64 | + RecordData = $null |
| 65 | + TTL = $null |
| 66 | + CacheEntryType = $null |
| 67 | + Section = $null |
| 68 | + } |
| 69 | + |
| 70 | + foreach ($line in $lines) { |
| 71 | + if ($line -match 'Record Name\s*:\s*(.+)$') { $entry.Name = $matches[1].Trim() } |
| 72 | + elseif ($line -match 'Record Type\s*:\s*(.+)$') { $entry.RecordType = $matches[1].Trim() } |
| 73 | + elseif ($line -match 'Time To Live\s*:\s*(\d+)') { $entry.TTL = [int]$matches[1] } |
| 74 | + elseif ($line -match 'Data:\s*(.+)$') { $entry.RecordData = $matches[1].Trim() } |
| 75 | + elseif ($line -match 'A\s+Record\s*:\s*(.+)$') { $entry.RecordData = $matches[1].Trim() } |
| 76 | + elseif ($line -match 'Cache Entry Type\s*:\s*(.+)$') { $entry.CacheEntryType = $matches[1].Trim() } |
| 77 | + elseif ($line -match 'Section\s*:\s*(.+)$') { $entry.Section = $matches[1].Trim() } |
| 78 | + } |
| 79 | + |
| 80 | + if ($entry.Name) { $results += $entry } |
| 81 | + } |
| 82 | + |
| 83 | + if ($Filter -ne '*') { |
| 84 | + $results = $results | Where-Object { |
| 85 | + ($_.Name -like $Filter) -or ($_.RecordData -like $Filter) -or ($_.RecordType -like $Filter) |
| 86 | + } |
| 87 | + } |
| 88 | +} |
| 89 | + |
| 90 | +# Output |
| 91 | +$results = $results | Sort-Object Name |
| 92 | +Write-Host '' |
| 93 | +Write-Host 'Entries found:' $results.Count |
| 94 | +Write-Host '' |
| 95 | + |
| 96 | +if ($results.Count -gt 0) { |
| 97 | + $results | Format-Table -AutoSize |
| 98 | + Write-Host '' |
| 99 | + Write-Host 'Match found — exiting with code 1.' |
| 100 | + exit 1 |
| 101 | +} else { |
| 102 | + Write-Host 'No DNS cache entries found.' |
| 103 | + exit 0 |
| 104 | +} |
0 commit comments