DNS questions

[generic_1]

What is the best way with built in HP tools to tell what processes are hammering a DNS server?
I know which servers are the culprits, but I have many apps running on these servers and would like to single them out.

Also on a side note, without loading a sniffer or other externel tool is there an easy way to see what ip is connecting to a port on a server?

[Juergen Tappe]

Try to use "lsof" a free tool listing any open files and network connection per process.

Its downloaded anywhere, but I cannot remeber where. Perhaps somebody knows the URL......

A standard Hp-UX command is : netstat -an
listing all incoming and outgoping used ports with IP Adress, but there is no easy way to indicated the related proccess ....

[Sundar_7]

For the second question, you can use netstat to find out the foreign IP address/Port

# netstat -an | grep -i EST

This should give you the established TCP connections. Here you can find both the local and the remote sockets (IP:port)

For the first question, as far as I can reach, I dont believe there is a way - my understanding is that application use the resolver libraries gethostbyaddr() and gethostbyname() for reverse and forward lookups. I would be curious to know if there is an alternate to this.

[generic_1]

How would I use lsof to capture what processes are making DNS requests?
Thanks for your replies.

[Geoff Wild]

lsof can be dl'd from:

http://hpux.ee.ualberta.ca/hppd/hpux/Sysadmin/lsof-4.70/

Here's the online man page:

http://hpux.ee.ualberta.ca/hppd/hpux/Sysadmin/lsof-4.70/man.html


Rgds...Geoff

[harry d brown jr · Accepted solution]

lsof is good for a "snapshot" of what's going on, but if you really want to know what's hammering your DNS, I suggest you upgrade BIND to 9.2, then turn debugging on.

live free or die
harry