Bind DNS - Find machine requesting lots of failing lookups

[humbletech99]

I am seeing lots of the failed lookups in fast succession in my logs and want a way of finding out which client ip is requesting those records from my Bind DNS servers. Any ideas how I can do this?

[RobinVossen]

You can use a Sniffer.
and then run a script over the Capture File to determin were it came from.

Hope that helps.

Cheers,
Robin

edit:
IDSes use this Method

[humbletech99]

yes but I think this is much more effort than it's worth.

plus this behaviour is sporadic so I can't just run this forever until I notice it again.

I've increased logging one Bind server to see if I get any more info.

[Lazydog]

Turn on "query_log" in your named.conf.
This should show you who is quering what. Then you should be able to grep it for the information you are looking for.

[humbletech99]

yes I did effectively this but using rndc while bind was running instead.

I didn't see it happen again, but will investigate the next time this happens.

Thanks.

[Lazydog]

I would still enable the logging and restart bind. At least you'll have some sort of history file to look back on.

[humbletech99]

I would still enable the logging and restart bind. At least you'll have some sort of history file to look back on.

what I did increases syslog logging, which should be enough. Anyway, I'll look at this again when I'm in the office.

Thanks