Re: How to log recursive queries?

bind-users-bounce@isc.org wrote on 05/04/2005 12:20:39 PM:
> bind-users-bounce@isc.org wrote on 05/04/2005 06:56:06 AM:
> > Hello,
> > Before I disable recursive queries on my name server, I'd like to find
> > out who is using it for that.
> >
> > I've seen the "queries" logging category, but can't see how to
restrict
> > it to just recursive queries. Is it possible?
>
> I think the answer to your question is no. However, you should be able
to
> write a perl script that could determine if someone is making a query in
a
> zone that that your name servers do not host. I would approach it like
> this:
>
> 1. Set up a logging statement to send query logging to a seperate file.
> 2. grep out your zone statements from your named.conf file. Use these
as
> a basis for determining if someone sent you a query for a RR that you do

> not hosts.
> 3. Write a perl script that parse through the query log, looking for
> queries outside of the list from step 2.
> 4. Record the IP address of anyone caught in step 3.
>

Or, even better yet, write a perl script that parses throught the query
log looking for an indication that the Recursion Desired bit was set. From
the BIND ARM:

"""""""""""""
Specify where queries should be logged to.

At startup, specifing the category queries will also enable query logging
unless querylog option has been specified.

The query log entry reports the client's IP address and port number. The
query name, class and type. It also reports whether the Recursion Desired
flag was set (+ if set, - if not set), EDNS was in use (E) or if the query
was signed (S).

client 127.0.0.1#62536: query: www.example.com IN AAAA +SE
client ::1#62537: query: www.example.net IN AAAA -SE
"""""""""""""""

Notice the "+" or "-" sign.


Wow, I guess I should have done a little more RTFM before my last post...


hth,

dave...




[clip...]