How to log recursive queries?

[David Botham]

bind-users-bounce at isc.org wrote on 05/04/2005 12:20:39 PM:
> bind-users-bounce at isc.org wrote on 05/04/2005 06:56:06 AM:
> > Hello,
> > Before I disable recursive queries on my name server, I'd like to find
> > out who is using it for that.
> > 
> > I've seen the "queries" logging category, but can't see how to 
restrict
> > it to just recursive queries. Is it possible?
> 
> I think the answer to your question is no.  However, you should be able 
to 
> write a perl script that could determine if someone is making a query in 
a 
> zone that that your name servers do not host.  I would approach it like 
> this:
> 
> 1.  Set up a logging statement to send query logging to a seperate file.
> 2.  grep out your zone statements from your named.conf file.  Use these 
as 
> a basis for determining if someone sent you a query for a RR that you do 

> not hosts.
> 3.  Write a perl script that parse through the query log, looking for 
> queries outside of the list from step 2.
> 4.  Record the IP address of anyone caught in step 3.
> 

Or, even better yet, write a perl script that parses throught the query 
log looking for an indication that the Recursion Desired bit was set. From 
the BIND ARM:

"""""""""""""
Specify where queries should be logged to.

At startup, specifing the category queries will also enable query logging 
unless querylog option has been specified. 

The query log entry reports the client's IP address and port number. The 
query name, class and type. It also reports whether the Recursion Desired 
flag was set (+ if set, - if not set), EDNS was in use (E) or if the query 
was signed (S).

client 127.0.0.1#62536: query: www.example.com IN AAAA +SE
client ::1#62537: query: www.example.net IN AAAA -SE
"""""""""""""""

Notice the "+" or "-" sign.


Wow, I guess I should have done a little more RTFM before my last post...


hth,

dave...




[clip...]