<div dir="ltr"><div><div>In upgrading from BIND 9.10 to 9.11, it looks as if the query log file format has changed slightly:<br><br></div>Previously (9.10 variant) the entry looked something like this:<br><br>04-Nov-2016 10:34:03.991 queries: info: client 172.20.10.48#38997 (36.2.20.172.in-addr.arpa): query: 36.2.20.172.in-addr.arpa IN PTR + (172.20.4.2)<br><br></div>Now (9.11.0-P2) it looks similar to this:<br><br><div class="gmail-raw-event gmail-normal gmail-wrap"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">24</span>-<span class="gmail-t">Jan</span></span>-<span class="gmail-t">2017</span></span> <span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">15</span>:<span class="gmail-t">49</span></span>:<span class="gmail-t">00</span></span>.<span class="gmail-t">999</span></span> <span class="gmail-t"><span class="gmail-t">queries</span>:</span> <span class="gmail-t"><span class="gmail-t">info</span>:</span> <span class="gmail-t">client</span> <span class="gmail-t">@<span class="gmail-t">0x7f6450002ef0</span></span> <span class="gmail-t"><span class="gmail-t gmail-a"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">172</span>.<span class="gmail-t">20</span></span>.<span class="gmail-t">10</span></span>.<span class="gmail-t">48</span></span></span>#<span class="gmail-t">60418</span></span> (<span class="gmail-t"><span class="gmail-t"><span class="gmail-t gmail-h"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">61</span>.<span class="gmail-t">2</span></span>.<span class="gmail-t">20</span></span>.<span class="gmail-t">172</span></span>.<span class="gmail-t">in</span></span>-<span class="gmail-t">addr</span></span>.<span class="gmail-t">arpa</span></span>)<span class="gmail-t">:</span> <span class="gmail-t"><span class="gmail-t">query</span>:</span> <span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">61</span>.<span class="gmail-t">2</span></span>.<span class="gmail-t">20</span></span>.<span class="gmail-t">172</span></span>.<span class="gmail-t">in</span></span>-<span class="gmail-t">addr</span></span>.<span class="gmail-t">arpa</span></span> <span class="gmail-t">IN</span> <span class="gmail-t">PTR</span> + (<span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">172</span>.<span class="gmail-t">20</span></span>.<span class="gmail-t">2</span></span>.<span class="gmail-t">2)<br><br></span></span></div><div class="gmail-raw-event gmail-normal gmail-wrap"><span class="gmail-t"><span class="gmail-t">I can discern what almost all of the fields signify except for the part "</span></span><span class="gmail-t">@<span class="gmail-t">0x7f6450002ef0".  I'm pretty sure its not the hex value for the client IP address because I have many of these types of entries where the client IP address remains the same but the "@0x" value changes.  <br><br></span></span></div><div class="gmail-raw-event gmail-normal gmail-wrap"><span class="gmail-t"><span class="gmail-t">Also, I can't seem to find anything in the ARM about this (but I may be looking in the wrong section (I was looking at the text on page 60).<br><br></span></span></div><div class="gmail-raw-event gmail-normal gmail-wrap"><span class="gmail-t"><span class="gmail-t">Thanks for any assistance,<br></span></span></div><div class="gmail-raw-event gmail-normal gmail-wrap"><span class="gmail-t"><span class="gmail-t">Mike<br></span></span></div><br></div>