Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
Networking
cancel
Showing results for 
Search instead for 
Did you mean: 

How can I find which process is doing DNS queries?

Patrick Provenzo
Frequent Advisor

How can I find which process is doing DNS queries?

I have several servers doing numerous dns queries to my DNS servers for an unrecognized name.   I need to find out what process is doing the queries.   Here is an example of the queries captured with TCPdump.

 

14:41:20.442106 IP esdq0920.abc.def.com.53230 > xxxdns.abc.def.com.domain: 6263+ AAAA? kane. (22)

14:41:20.444671 IP esdq0920.abc.def.com.53231 > xxxdns.abc.def.com.domain: 6264+ A? kane.abc.def.com. (34)

14:41:20.445160 IP esdq0920.abc.def.com.53232 > xxxdns.abc.def.com.domain: 6265+ A? kane.essc.def.com. (35)

14:41:20.446055 IP esdq0920.abc.def.com.53233 > xxxdns.abc.def.com.domain: 6266+ A? kane.def.com. (30)

14:41:20.447854 IP esdq0920.abc.def.com.53234 > xxxdns.abc.def.com.domain: 6267+ A? kane.hyd.def.com. (34)

14:41:20.449797 IP esdq0920.abc.def.com.53235 > xxxdns.abc.def.com.domain: 6268+ A? kane.wywy.ad.etn.com. (38)

14:41:20.451811 IP esdq0920.abc.def.com.53236 > xxxdns.abc.def.com.domain: 6269+ A? kane.ch.def.com. (33)

 

P.S. This thread has been moved from HP-UX>General to HP-UX > networking. -HP Forum Moderator

2 REPLIES
Dennis Handly
Acclaimed Contributor

Re: How can I find which process is doing DNS queries?

If you use tusc on each process you might be able to detect this.

eric_wilford
Occasional Visitor

Re: How can I find which process is doing DNS queries?

You can use the HP-UX tool nettl(1m) to take a network trace and then format it using netfmt with the -N (nice formatting) options. In the meta data of each pack you will see a field called "PID". In 11.31 this is the actual PID of the process that sent the packet. On previous version this is actually a kernel thread ID so you would need to use another tool to map that to a process ID. Of course you would have to look through the trace to find an outbound DNS packet and this only "works" if the process is long enough lived that you can catch it in a "ps" listing taken at the same time as the nettl trace was taken.