Getting source IP for notify? (9.2.1)

Mark_Andrews at isc.org Mark_Andrews at isc.org
Wed Sep 3 02:36:16 UTC 2003


> Since the ISC mailling list subscription page is broken (I've mailed
> listmaster at isc.org a week ago), can anyone tell me how to get 
> the IP of a site sending me a notify (using bind 9.2.1)? 
> 
> Aug 31 05:21:18 lerami in.named[7737]: received notify for zone '0-26.122.158
> .207.in-addr.arpa': not authoritative
> Aug 31 05:21:18 lerami in.named[7737]: received notify for zone '0-26.122.158
> .207.in-addr.arpa': not authoritative
> Aug 31 08:13:11 lerami in.named[7737]: received notify for zone '0-26.122.158
> .207.in-addr.arpa': not authoritative

	Use a packet filter to filter out the notify messages (filter on the
	opcode) then corollate the two logs.

	BIND 9.3 will log the client (sender) address.

	FYI the zone is delegated to these servers.  Only your server
	is actually answering even if it is SERVFAIL.

0-26.122.158.207.in-addr.arpa. 86400 IN NS      ns1.phyrebyrd.net.
0-26.122.158.207.in-addr.arpa. 86400 IN NS      ns1.cheerco.net.
0-26.122.158.207.in-addr.arpa. 86400 IN NS      ns-a.lerctr.org.

	Mark
 
> Thanks!
> LER
> -- 
> Larry Rosenman                     http://www.lerctr.org/~ler
> Phone: +1 972-414-9812                 E-Mail: ler at lerctr.org
> US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at isc.org


More information about the bind-users mailing list