Logging DNS queries

Is there a way to log all DNS queries going to a Novell DNS server?
The reason I ask is we're about to transition our DNS & DHCP services off of Novell and over to an appliance-based solution from Infoblox.
There are five main steps to our transition:
Transfer DNS zone data to Infoblox grid
Reconfigure Novell DNS servers to be Cache-Only servers (have them forward all queries to Infoblox)
Reconfigure DHCP options to use Infoblox DNS servers
Reconfigure devices with static IPs to use Infoblox DNS servers
Decommission Novell DNS servers
The tricky part is #4: our environment has numerous sites and thousands of devices, and I feel that telling my network techs to check everything isn't practical or reasonable.
If there's a way to log the DNS activity going to the old servers it'll give my techs something definitive to work with.
Any suggestions?

Most of them are NetWare 6.5 SP8, a few are OES 2 Linux.
>>> Simon Flood<[email protected]> 2/19/2013 12:26 PM >>>
On 19/02/2013 13:21, Wallace Marks wrote:
> Is there a way to log all DNS queries going to a Novell DNS server?
> The reason I ask is we're about to transition our DNS & DHCP services
> off of Novell and over to an appliance-based solution from Infoblox.
> There are five main steps to our transition:
>
> 1. Transfer DNS zone data to Infoblox grid
> 2. Reconfigure Novell DNS servers to be Cache-Only servers (have them
> forward all queries to Infoblox)
> 3. Reconfigure DHCP options to use Infoblox DNS servers
> 4. Reconfigure devices with static IPs to use Infoblox DNS servers
> 5. Decommission Novell DNS servers
>
> The tricky part is #4: our environment has numerous sites and thousands
> of devices, and I feel that telling my network techs to check everything
> isn't practical or reasonable.
> If there's a way to log the DNS activity going to the old servers it'll
> give my techs something definitive to work with.
> Any suggestions?
Are your Novell DNS servers running NetWare or OES (Linux)?
HTH.
Simon
Novell/SUSE/NetIQ Knowledge Partner
Do you work with Novell technologies at a university, college or school?
If so, your campus could benefit from joining the Novell Technology
Transfer Partner (TTP) program. See novell.com/ttp for more details.

Similar Messages

Some CNAME DNS queries fail after latest 10.6.5 update

Right after rebooting from the latest MacOS X update I noticed some DNS queries are failing. These happen to be DNS queries for CNAME records. Other computers in the same network are not affected by this problem, including Mac's to wich the update was not yet installed.
Here are the simple diagnostic steps:
snowboard:~ pmsjt$ nslookup imap.texair.net.
Server: 192.168.0.14
Address: 192.168.0.14#53
imap.texair.net canonical name = taz.warner.local.
Name: taz.warner.local
Address: 192.168.0.12
snowboard:~ pmsjt$ ping imap.texair.net
ping: cannot resolve imap.texair.net: Unknown host
snowboard:~ pmsjt$
snowboard:~ pmsjt$ ping taz.warner.local
PING taz.warner.local (192.168.0.12): 56 data bytes
64 bytes from 192.168.0.12: icmp_seq=0 ttl=64 time=2.818 ms
64 bytes from 192.168.0.12: icmp_seq=1 ttl=64 time=2.211 ms
64 bytes from 192.168.0.12: icmp_seq=2 ttl=64 time=1.425 ms
64 bytes from 192.168.0.12: icmp_seq=3 ttl=64 time=2.242 ms
64 bytes from 192.168.0.12: icmp_seq=4 ttl=64 time=4.882 ms
64 bytes from 192.168.0.12: icmp_seq=5 ttl=64 time=3.190 ms
^C
--- taz.warner.local ping statistics ---
6 packets transmitted, 6 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.425/2.795/4.882/1.083 ms
snowboard:~ pmsjt$

Just as a sanity check, the second portion of the clause from the KB article doesn't apply in your situation, does it?
Additionally, Mac OS X v10.6 automatically detects when the local network operator has set up a name server that will answer name requests for a domain ending in ".local". It does this by checking to see if there is a Start Of Authority (SOA) record for the top level domain "local", which is how a DNS server indicates that it claims to have authority over a part of the DNS namespace. As long as the DNS server is properly configured with the required SOA record, Mac OS X v10.6 will detect this SOA record and automatically use this server to look up all host names in the domain.
Also, if you have time, you might want to check what mDNSResponder is actually doing by enabling logging; the man page describes the process in more detail:
LOGGING
There are several methods with which to examine mDNSResponder's internal state for debugging and
diagnostic purposes. The syslog(1) logging levels map as follows:
Error - Error messages
Warning - Client-initiated operations
Notice - Sleep proxy operations
Info - Informational messages
By default, only log level Error is logged.
A SIGUSR1 signal toggles additional logging, with Warning and Notice enabled by default:
% sudo killall -USR1 mDNSResponder
Once this logging is enabled, users can additionally use syslog(1) to change the log filter for the
process. For example, to enable log levels Emergency - Debug:
% sudo syslog -c mDNSResponder -d
A SIGUSR2 signal toggles packet logging:
% sudo killall -USR2 mDNSResponder
A SIGINFO signal will dump a snapshot summary of the internal state to /var/log/system.log:
% sudo killall -INFO mDNSResponder
http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/ man8/mDNSResponder.8.html
I suspect in this case packet logging might be most informative.

How can I disable DNS queries in Firefox (when using a proxy) ?

I am behind a "Chinese wall" and use an HTTP proxy to tunnel and encrypt my data traffic.
Unfortunately, Firefox still sends DNS queries for the websites, that I visit and reveals more information than I want.
Is there a way to disable DNS, when I use an HTTP/S proxy ?
My current workaround is to set a firewall rule for outbound DNS traffic of Firefox. But not all users are able to configure their firewall.

That is done via an onbeforeunload or onunload event that displays a JavaScript alert.
*https://developer.mozilla.org/en/DOM/window.onbeforeunload
*https://developer.mozilla.org/en/DOM/window.onunload
You can try to search for a Greasemonkey script to reset and block such events.
*http://www.greasespot.net/ - Greasemonkey
*http://wiki.greasespot.net/Main_Page - GreaseSpot

Applications sending ipv6 dns queries, but ipv6 is disabled

Hi,
I had some problems with dns lookups a long time ago and so I followed every hint I could find here in the forums and the wiki, like disabling ipv6, installing dnsmasq, and so on. Firefox and other typical internet applications worked like a charm after that.
Pacman instead took a long time to lookup the ip for the chosen mirror url, but I didn't bother to look deeper into this issue, until now.
Wireshark revealed that the dns query that is sent by pacman (and some other console applications like w3m, wget, but not lynx ...) is an AAAA query for an ipv6 address. In spite of ipv6 being disabled.
Additionally my router (which is added in /etc/resolv.conf) ignores the query, it times out, and after 5 seconds, the AAAA query is sent again.
This happens 4 times and then a query for the A record is sent which is answered promptly.
(A simple "w3m google.com" takes up to 1min 20sec with all the lookups following the 301 and 302 answers...)
Well, a workaround for this is obvious. I could use a nameserver that answers the AAAA query, which I already tried with the opendns server.
But the question that I have is: Why are some applications sending dns queries for ipv6 addresses although ipv6 is disabled?
Regards,
Marc

Hi,
I had some problems with dns lookups a long time ago and so I followed every hint I could find here in the forums and the wiki, like disabling ipv6, installing dnsmasq, and so on. Firefox and other typical internet applications worked like a charm after that.
Pacman instead took a long time to lookup the ip for the chosen mirror url, but I didn't bother to look deeper into this issue, until now.
Wireshark revealed that the dns query that is sent by pacman (and some other console applications like w3m, wget, but not lynx ...) is an AAAA query for an ipv6 address. In spite of ipv6 being disabled.
Additionally my router (which is added in /etc/resolv.conf) ignores the query, it times out, and after 5 seconds, the AAAA query is sent again.
This happens 4 times and then a query for the A record is sent which is answered promptly.
(A simple "w3m google.com" takes up to 1min 20sec with all the lookups following the 301 and 302 answers...)
Well, a workaround for this is obvious. I could use a nameserver that answers the AAAA query, which I already tried with the opendns server.
But the question that I have is: Why are some applications sending dns queries for ipv6 addresses although ipv6 is disabled?
Regards,
Marc

MySQL problem: can't get log-slow-queries to work

I've edited added the requisite lines to /etc/my.cnf (which is being read on start up):
[slowqueries]
longquerytime = 5
log-slow-queries=/var/log/mysql-slow-queries.log
And I've tried different locations for the log file, and I've chown'd it to :wheel, then chmod'd it to 777 (which means any user/process can write to it, right?). And even though I run queries that are longer than five seconds, the file still is neither created, nor if existing, is written to. Any ideas? This seems so straightforward according to the MySQL and Apple docs. I can't figure out what it's not happening.
/// RDF

The CAPS LOCK key also seems to have gotten stuck on.*
Update 51 ratcheted up the security on Java applets, so that unsigned applets that used to generate a warning are now completely blocked. Please see the following documentation from Oracle on your options:
* [http://www.java.com/en/download/help/appsecuritydialogs.xml What should I do when I see a security prompt from Java?]
* [http://www.java.com/en/download/faq/exception_sitelist.xml How can I configure the Exception Site List?]
''* Just a joke-y way of noting that on the web, writing in all caps is considered shouting. Please don't shout at the volunteers.''

Home Hub 3 Firmware update stops DNS queries and m...

I am getting very poor service after 5 phones about my incident 1403**-******. The staff cannot understand my problem even though I have explained in clear technical detail. Basically a firmware update has caused my BT Home Hub 3 to have very slow management web interface and fails to handle DNS queries. It connects to the Internet Fine.
The Home Hub has been rebooted and reset many times and no improvement.
Help BT.

I have been DNS having problems with two Chromebooks accessing the internet ever since the latest firmware upgrade to my HH3 on 15 March - calls to BT went over their heads they just blamed it on the Chromebook as no other devices were having problems despite the fact that I made it clear that the problem only started after the latest upgrade - the muppet dealing with the problem even went as far as to say that BT does not support more than 6 devices connected to the hub at anyone time.
I found that the DNS problem does not affect you if you switch from the HH to BT FON even when you are on your own network.
I finaly got round the problem on the chromebooks by going into the settings page on the Chromebook, opening the HH3 settings and selecting the option to use 'Google name servers' from the 'Network' tab.
It has long been an issue for me that the HH3 does not allow me to set my own choice of DNS unless I subscribe to a Dynamic DNS provider from their list - I prefer to use Open DNS to control my network as it allows me to filter out content across the whole network but to do this I would need to replace the HH and that would mean I would lose the Vision service

Can't do traceroute or DNS queries withing a non-global zone.

I'll start by outlining my servers and their roles
they are all on the same network, behind the same gateway, plugged into the same switch.
secure1 = a freebsd server running bind. It's a recursive DNS server. works perfectly.
secure2 = a solaris 10 server.
zone1 = a zone that was setup before i inherited this env.
zone2 = a zone i tried to create, and it mostly worked.
The problem:
From zone2 I cannot do DNS queries. And traceroutes past the gateway don't work. At first I suspected the firewall, but everything that doesn't work on zone2, works fine on zone 1.
What does work on zone2
I can ssh into it
I can ssh out of it
I can ping it
I can ping from it
I can trace route from it to secure1
I can ssh to other hosts out on the internet.
What doesn't work
I can't do any DNS queries, whether the DNS server is inside of my network or outside of it.
I can't traceroute past my gateway, tho I can from zone1.
Finally here's what happens when I do a dns query
zone2# /usr/sbin/host google.com 66.48.78.91
;; connection timed out; no servers could be reached
Oh, I diffed the zone1.xml and zone2.xml files in /etc/zones and except for things like ip addresses they are the same.
Any suggestions would be muchly appreciated. Thanks folks.

ifconfig -a and netstat -rn from the zone that isn't working properly would help.
Off the top of my head, my guess is that your default route isn't valid for zone 2.

Migrating to nsd/unbound from bind for local dns queries

As it was recently announced that the maintainer of the bind package intends to withdraw support for bind10 in arch when it is released, I decided to move my own systems from running bind to running unbound as the recursive caching dns server in my laptops, and this package in combination with nsd as an authoritative-only dns server on one of the local network machines to provide local dns. Having done a little research on these two packages before starting out, I found that nsd is in fact used on three of the root dns servers, and has an excellent security pedigree if the CVE statistics are monitored. For example:
http://www.cvedetails.com/product/17420 … or_id=9613
http://www.cvedetails.com/product/18208 … r_id=10197
both look good compared the stats for bind at
http://www.cvedetails.com/product/144/I … ndor_id=64
Having got the packages working on all my machines now, and having had them running very well and stable for some days I thought I would put some information on the arch wiki to help anyone else doing the same migration. Once the migration is complete then the bind package is no longer needed on any of the machines and can be removed. I understand that anyone already running bind will continue to be able to run that package but it will then become unmaintained and it is therefore worth migrating to supported packages that achieve the same functionality but with added security since separating the authoritative dns functions from those of caching and recursive dns allows one to tighten security on the authoritative server in a way that is not possible when running all dns functions within a single package such as bind. In addition package updates including security fixes will then enable the supported packages to provide a cutting edge dns service.
https://wiki.archlinux.org/index.php/Unbound
https://wiki.archlinux.org/index.php/Nsd
There are also a lot of useful hints on the web page at
https://calomel.org/nsd_dns.html
https://calomel.org/unbound_dns.html
and links from those pages.
Of course the same packages can also provide dns queries for wan facing web and mail servers and allow queries from outside of the local network as well in the same way that bind as been providing such services on many web and mail servers for many years by changing the configuration files accordingly.
I hope that this may help other users who want to set up dns servers on their systems.
Last edited by mcloaked (2013-03-16 15:06:04)

As it was recently announced that the maintainer of the bind package intends to withdraw support for bind10 in arch when it is released, I decided to move my own systems from running bind to running unbound as the recursive caching dns server in my laptops, and this package in combination with nsd as an authoritative-only dns server on one of the local network machines to provide local dns. Having done a little research on these two packages before starting out, I found that nsd is in fact used on three of the root dns servers, and has an excellent security pedigree if the CVE statistics are monitored. For example:
http://www.cvedetails.com/product/17420 … or_id=9613
http://www.cvedetails.com/product/18208 … r_id=10197
both look good compared the stats for bind at
http://www.cvedetails.com/product/144/I … ndor_id=64
Having got the packages working on all my machines now, and having had them running very well and stable for some days I thought I would put some information on the arch wiki to help anyone else doing the same migration. Once the migration is complete then the bind package is no longer needed on any of the machines and can be removed. I understand that anyone already running bind will continue to be able to run that package but it will then become unmaintained and it is therefore worth migrating to supported packages that achieve the same functionality but with added security since separating the authoritative dns functions from those of caching and recursive dns allows one to tighten security on the authoritative server in a way that is not possible when running all dns functions within a single package such as bind. In addition package updates including security fixes will then enable the supported packages to provide a cutting edge dns service.
https://wiki.archlinux.org/index.php/Unbound
https://wiki.archlinux.org/index.php/Nsd
There are also a lot of useful hints on the web page at
https://calomel.org/nsd_dns.html
https://calomel.org/unbound_dns.html
and links from those pages.
Of course the same packages can also provide dns queries for wan facing web and mail servers and allow queries from outside of the local network as well in the same way that bind as been providing such services on many web and mail servers for many years by changing the configuration files accordingly.
I hope that this may help other users who want to set up dns servers on their systems.
Last edited by mcloaked (2013-03-16 15:06:04)

Cisco 877W acting a a DNS server. Does it answer external DNS queries coming from the WAN

Hello,
I have a Cisco 877W running on my ADSL2+ service at home.
It is setup to act as a DNS server to answer DNS queries for my LAN and has the below commands as part of its configuration
ip dns server
ip dhcp pool LAN
network 192.168.2.0 255.255.255.0
default-router 192.168.2.254
dns-server 8.8.8.8
My question is, when I scan my WAN IP for open ports, port 53 (DNS) is open. Does this mean my router will be acting as a DNS server for anyone on the internet who directs DNS queries to my WAN IP?
If so, am I able to turn off port 53 towards the Internet, or do I need to add an an access-list to only accept queries from my internal network.
Thanks for your feedback.

That's correct. The "ip dns server" command will answer queries on any interface.
Given that your DHCP server is telling your clients to use Google DNS and not your router, I would just turn the router's DNS server off with the "no ip dns server" command.
Setting up an ACL (and/or inspection or zone-based firewalling) on your Internet-facing interface is the best practice to protect your network in general, not just to prevent external DNS queries.

Logging sql queries without any changes in existing apps

Hi!
Is it possible to log all SQL queries send from application to database via JDBC without any (or really small) changes in code of existing applications?
I'm new to JDBC so any suggestions/ideas/best practices are welcome ;)
Best regards.
Edited by: matthew_ on Mar 16, 2008 5:35 PM

Is it possible to log all SQL queries send from application to database via JDBCFirst is an assumption that the driver does in fact sends SQL. It might send some other form.
But excluding that and excluding that the driver explicitly sends it then you can create a proxy driver. You implement the driver to pass everything to the real driver. Along the way it collects the information.
You will find that that is quite bit of work. However it impacts the actual code very little and requires nothing more than loading the driver and changing the connection string in the code where it is used.

Firefox leaking DNS queries when using a proxy

When configuring firefox to use a PAC file for proxy configuration, or when using the "system proxy settings" option, firefox queries the internal DNS server for every request, instead of using the proxy. I've see other "bugs" people have mentioned when using a socks proxy that sound similar, but this happens with just a regular proxy in my example (over port 8080)

Hi,
Which edition of windows server you are running?
You can point your clients to proxy server via GPO or GPP:
For previous version:
userconfig->policy->
windows
settings->
internet
explore
maintence
And the later version:
user
config->preference->control panel settings->internet settings->new
Appendix B: Replacements for Internet Explorer Maintenance
http://technet.microsoft.com/en-us/library/jj890998.aspx
Hope this helps.

System.log DNS Error, help

Hi, I am using a fairly old app on my Server that runs on the desktop and reads log files (name of the app is MKConsole, it's VERY handy) and I keep getting this error...
"Jan 10 20:19:36 G4-Server servermgrd: servermgr_dns: no name available via DNS for 192.168.1.10
Jan 10 20:19:36 G4-Server servermgrd: servermgr_dns: no hostname set and unable to detect via DNS, services may not function properly - use changeip to repair"
I have tried using "chageip" and have done man changeip to see if I was missing anything but I was not, and the problem persists. Does anyone know a way to fix this? I don't think it is a problem with the DNS Services, because I have tried turning DNS services off and it still came up woth the error.
Thanks!

The problem isn't necessarily with your server, but the DNS server that it uses.
The server is trying to resolve its own IP address, so it's asking the DNS server for the reverse lookup of 192.168.1.10. The DNS server doesn't have a reverse entry for that IP, and that's why the server is complaining.
Your fix is to make sure that your DNS is setup correctly, with correct reverse DNS for your server.

Log DNS record Creation / deletion events on DC's security event viwer

hi,
I have configured the DNS record creation and deletion auditing as per below microsoft blog
http://blogs.technet.com/b/networking/archive/2011/08/17/tracking-dns-record-deletion.aspx on one of my DC.
All setting are done correctly and events for DNS creation and deletion is generated in security event logs. BUT THESE EVENTS ARE ONLY GENERATED ON ONE DC. We have 3 other DC, i checked the security events on other 2 DC but there is no event logs. Only one
DC has that events.
Is there any way so that whenever DNS record is created / deleted the events SHOULD CREATED ON ALL DCs. This will save time else i have to check on all DCs security events.
Please suggest

Greetings!
It is by design. When you want to create a record in on of the DNS servers, you open the DNS console and connect to a server. Record creation/deletion is a single server process, and after that it is replicated to all the DNS servers using Zone Transfers
or AD Integrated Zones. Since this is a single server process the audit is generated in the server's event viewer itself.
So he best thing you can do is to collect all the events regarding "DNS Auditing" from your DNS servers and store them in a server. More information on:
Configure Computers to Forward and Collect Events
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

How to determine which IP address and port is used to make DNS queries?

I am using JNDI/DNS API to query a Enum server (Tel URI resolution in VOIP world) what is a DNS server.
But I have many network interfaces, in a VLAN environment, and I must to specify from which interface (and port)
all the requests are sent.
When I read the code of JNDI/DNS API (in JDK 1.5) and specially the DNSClient class, I can see that the
DatagramSocket is created without parameters... : udpSocket = new DatagramSocket();
How can I specify the IP address and port to use for my client???
Thanks for your help.

I must to specify from which interface (and port) all the requests are sent. You don't have to specify the interface unless your static unicast routing tables are incorrect, and you never have to specify the port unless some lunatic is in control of your firewall.

Multiple Forest DNS queries, and DFS

Setup:
2 physical servers hosting several virtual machines with 3 forests (domains) and 3 subnets. The physical server has 4 NICs, each forest/subnets has its own dedicated NIC via virtual switch (so 1 NIC is empty). Each NIC connects to a switch to
allow workstations and other devices to connect to their proper forest/subnet directly. These switches then connect to the sonicwall (firewall/router) in an individual port. Each port has proper subnet defined in it.
The 3 forests are c.com, l.lan, and w.web named. c.com and l.lan use a 10.x.x.x/255.255.0.0 subnet. w.web uses 192.168.x.x/255.255.0.0 subnet. There are no trusts setup.
I can ping from one forest/subnet to the other using IP address without issue so the IP routes are fine. I can ping via FQDN without issue if I setup a forwarder, conditional forwarder, or stub zone. Sometimes using just the forwarder, FQDN does
NOT resolve. Conditional and Stub seems to resolve always.
I can get c.com and w.web to resolve single-name (host name) addresses, but at the moment (transitioning) they are on the same subnet. From some research, I can use single-name resolution if I setup a GlobalNameZone as well, which I might need to do.
So my question is which is best practice and most reliable way to setup these different forests and subnets to perform DNS resolution? I tried forwarders, but it wasn't always reliable. I suspected caching as an issue, but after a flush, a FQDN
would sometimes resolve and sometimes not. Conditional and Stub seem to work okay, but I'm not sure about what's best.
I've spent most of the day researching this, and nothing was every really definitive and sometimes even contradictory. Previously the DNS Forwarders worked fine for us, but that was on the same subnet. Differing subnets seems to break the internal-to-internal
forwarding.
Additionally the w.web domain has a domain level DFS. Neither of the other forests can access it via the
\\w.web\data address. Though they can access it if I point them directly to the server hosting the DFS namespace.

Windows Server doesn't work well with DNS Search Suffixes defined in DHCP scopes from what I read.
http://technet.microsoft.com/en-us/library/dd572752(v=office.13).aspx
Details how to set it up on Windows Server DHCP
http://social.technet.microsoft.com/Forums/en-US/2eed4d4f-8d1b-4989-ac49-d95e08b7d54a/dhcp-dns-suffix-search-list-supported?forum=winserverNIS
Details how Windows Server does not support it though.
http://technet.microsoft.com/en-us/library/bb847901(v=exchg.150).aspx
Details how to use Group Policy to deploy it.
How I fixed this:
1) Open Group Policy for the domain.
2) Edit the "Default Domain Policy" to include DNS Suffix search for current domain and all other domains.
3) Set normal forwarders on domain's DNS servers.
4) Repeat on all domain.
This partially fixed my problem. Things were resolving more reliably, but there would be a failure once in a while as well. I corrected this by adding a conditional forwarder along with the normal forwarder.
Now I get full resolution of all items. Additionally, I do not have to use the FQDN for my machines. Just hostname resolves just fine. HOWEVER I would suggest to anyone setting up machines to use FQDN where possible, don't be lazy.
This means I will not have to setup a GlobalName zone either. Though I may do it for the experience.
Another problem though is this only works on Windows machines. Mobile phones (such as Android and iPhone) and other such devices will not know about the DNS Suffix search. Fortunately most of those devices required the internet FQDN for services
to work anyway, and when behind the firewall via WiFi or like, they'll be able to still resolve the internet FQDN of devices since we're using a split-brain DNS for that domain.

Logging DNS queries

Similar Messages

Maybe you are looking for