1

How can I log which interface a BIND query is received on?

view story
linux-howto

http://serverfault.com – I'm in the process of changing the IP address of my nameserver and I want a way to tell how many queries I am still receiving on the old IP address to track how well the change is being picked up. Is this something I can do in BIND9 logging or would I have to go outside it to something like tcpdump to track this? I want to still process queries on multiple IPs but I want some sign of the relative quantity of queries between the 2 IPs. (HowTos)

xskl's picture
Submitted by xskl on 09/14/2011

Stories similar to How can I log which interface a BIND query is received on?

I have a NT4 server that in the last two weeks started to generate too many weird DNS queries to the DNS server is set to use.

I am using MAMP Pro 2.0.5 (latest) and copied the my-medium.cnf file and placed it into /mamp/conf/ and renamed it to my.cnf under the [mysqld] i placed

log = /Volumes/www/public/logs/mysql-queries.log

to get the log going ( i want to log all queries)

but nothing happends. I resarted mamp and when i run queries nothing gets logged. what am i doing wrong?

Hi guys,

For a few weeks now my server is notifying me with around a hundred per day denied queries of the form:

Code: client 99.999.99.99 query (cache) 'www.someserver.com/A/IN' denied: 1 Time(s) Originating IPs, here portrayed as 99.999.99.99, are always two - which makes me believe it is either a script kiddie or an owned machine.

On a given day, each query has a different www.so

I just added another index to a table in my database but now the site is crashing, queries get locked and not unlocked and queries are not executed (I can see them in the process list and they usually take less than a second to execute but now they are at around 600 seconds and more etc.).

I didn't change anything on my site, just added an index.

I know that to disable recursive queries in BIND, I need add the following lines to the options section of /etc/bind/named.conf.options

allow-transfer {“none”;}; allow-recursion {“none”;}; recursion no;

Will the above configuration disable all DNS recursive queries?

How can I disable DNS recursion only to external network queries and keep recursion only for Internal network?

If I disable the

I have enabled my slow query log. So I saw the query which was taking some time then I did some indexing it improve and my slow query log is not being showing any more queies.

glTail and Bind9 logs 38 weeks 3 days ago

My bind9 server logs queries to syslog and it produces lines like this in /var/log/syslog

Aug 23 17:25:41 serverdns named[1690]: client 10.10.10.20#35495: query: 52.122.168.109.blackholes.easynet.nl IN A + (10.10.10.1)

How can I configure the named.rb parser of glTail to parse such lines? Do I have to change my Bind9 logging configuration? Can you give me an example?

I'm trying to help someone configure a MS 2008 DNS Server, that it doesn't answer DNS queries from the root zone as well as only answers queries with the recursive bit set from the lan it's connected to. Those two measurements are meant to avoid using the server as DDoS-Bounce server as well as cache snooping.

I'm running Centos 5.8 (bind 9.3.6).

Here is my issue... I admin my own DNS server which is colocated at an ISP.

I would like to allow a select few external systems use my DNS server. The external systems can have a dynamic IP address, so I am not sure how this would be accomplished.

In my named.conf, there is an allow-query{} and allow-recursion{}.