Find the answer to your Linux question:
Results 1 to 7 of 7
I am seeing lots of the failed lookups in fast succession in my logs and want a way of finding out which client ip is requesting those records from my ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Newbie humbletech99's Avatar
    Join Date
    Nov 2005
    Posts
    225

    Bind DNS - Find machine requesting lots of failing lookups


    I am seeing lots of the failed lookups in fast succession in my logs and want a way of finding out which client ip is requesting those records from my Bind DNS servers. Any ideas how I can do this?
    The Human Equation:

    value(geeks) > value(mundanes)

  2. #2
    Linux Engineer RobinVossen's Avatar
    Join Date
    Aug 2007
    Location
    The Netherlands
    Posts
    1,429
    You can use a Sniffer.
    and then run a script over the Capture File to determin were it came from.

    Hope that helps.

    Cheers,
    Robin

    edit:
    IDSes use this Method
    New Users, please read this..
    Google first, then ask..

  3. #3
    Linux Newbie humbletech99's Avatar
    Join Date
    Nov 2005
    Posts
    225
    yes but I think this is much more effort than it's worth.

    plus this behaviour is sporadic so I can't just run this forever until I notice it again.

    I've increased logging one Bind server to see if I get any more info.
    The Human Equation:

    value(geeks) > value(mundanes)

  4. $spacer_open
    $spacer_close
  5. #4
    Linux Guru Lazydog's Avatar
    Join Date
    Jun 2004
    Location
    The Keystone State
    Posts
    2,677
    Turn on "query_log" in your named.conf.
    This should show you who is quering what. Then you should be able to grep it for the information you are looking for.

    Regards
    Robert

    Linux
    The adventure of a life time.

    Linux User #296285
    Get Counted

  6. #5
    Linux Newbie humbletech99's Avatar
    Join Date
    Nov 2005
    Posts
    225
    yes I did effectively this but using rndc while bind was running instead.

    I didn't see it happen again, but will investigate the next time this happens.

    Thanks.
    The Human Equation:

    value(geeks) > value(mundanes)

  7. #6
    Linux Guru Lazydog's Avatar
    Join Date
    Jun 2004
    Location
    The Keystone State
    Posts
    2,677
    I would still enable the logging and restart bind. At least you'll have some sort of history file to look back on.

    Regards
    Robert

    Linux
    The adventure of a life time.

    Linux User #296285
    Get Counted

  8. #7
    Linux Newbie humbletech99's Avatar
    Join Date
    Nov 2005
    Posts
    225
    Quote Originally Posted by Lazydog View Post
    I would still enable the logging and restart bind. At least you'll have some sort of history file to look back on.
    what I did increases syslog logging, which should be enough. Anyway, I'll look at this again when I'm in the office.

    Thanks
    The Human Equation:

    value(geeks) > value(mundanes)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •