Interpreting DNS log

Question

I got a 2008 server with 2 NIC, one public, the other private. The public NIC should register its A record, and it does, which is good. The private should NOT register its record - we disabled the option accordingly in TCP/IP stack - but the record comes
back from time to time(very far and few between). I am suspecting something other than the NIC is doing the registration, so I enabled DNS log. Below is one entry from the log coming from the server itself. But my question is not about how the record was registered
- I am still working on it - instead, my question is how to interpret the log below. It seems that the server is regstering the private IP based on the entry, but I don't see the record created in DNS. Same update request can be seen in log quite often.
In short, record for private IP is NOT getting created most of the time while the log says otherwise. What gives?
12/12/2013 9:34:31 AM 07A8 PACKET  00000000095AE940 UDP Snd 172.31.85.66    eef2 R U [00a8       NOERROR] SOA    (8)domain(2)parentdomain(13)com(0)
UDP response info at 00000000095AE940
  Socket = 448
  Remote addr [public IP of server here], port 56769        <---------------------------
  Time Query=2212181, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0067 (103)
  Message:
    XID       0xeef2
    Flags     0xa800
      QR        1 (RESPONSE)
      OPCODE    5 (UPDATE)   <-----------
      AA        0
      TC        0
      RD        0
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    ZCOUNT    1
    PRECOUNT  0
    UPCOUNT   1
    ARCOUNT   0
    ZONE SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(8)domain(2)parentdomain(13)com(0)"
      ZTYPE   SOA (6)
      ZCLASS  1
    PREREQUISITE SECTION:
      empty
    UPDATE SECTION:
    Offset = 0x002f, RR count = 0
    Name      "(10)ServerName(8)domain(2)parentdomain(13)com(0)"
      TYPE   A  (1)
      CLASS  254
      TTL    0
      DLEN   4
      DATA   [Private IP here]   <----------------------------------------
    ADDITIONAL SECTION:
      empty

Answer 1

Hi,
Firstly, please refer to the link below to better understand the DNS log:
http://www.zytrax.com/books/dns/ch15/#rdata
In addition, did you mean that the DNS server was multihomed (with two NICs)? If yes, please refer to the links below:
Steps to avoid registering unwanted NIC(s) in DNS on a Mulithomed Domain Controller
http://support.microsoft.com/kb/2023004
How does a DNS query work in a multi-homed PC?
http://social.technet.microsoft.com/Forums/windowsserver/en-US/d0aa6307-41bb-43d1-b918-d9794747958d/how-does-a-dns-query-work-in-a-multihomed-pc?forum=winserverPN
Best regards,
Susie