How can I find which process is doing DNS queries?

[Patrick Provenzo]

I have several servers doing numerous dns queries to my DNS servers for an unrecognized name.   I need to find out what process is doing the queries.   Here is an example of the queries captured with TCPdump.

14:41:20.442106 IP esdq0920.abc.def.com.53230 > xxxdns.abc.def.com.domain: 6263+ AAAA? kane. (22)

14:41:20.444671 IP esdq0920.abc.def.com.53231 > xxxdns.abc.def.com.domain: 6264+ A? kane.abc.def.com. (34)

14:41:20.445160 IP esdq0920.abc.def.com.53232 > xxxdns.abc.def.com.domain: 6265+ A? kane.essc.def.com. (35)

14:41:20.446055 IP esdq0920.abc.def.com.53233 > xxxdns.abc.def.com.domain: 6266+ A? kane.def.com. (30)

14:41:20.447854 IP esdq0920.abc.def.com.53234 > xxxdns.abc.def.com.domain: 6267+ A? kane.hyd.def.com. (34)

14:41:20.449797 IP esdq0920.abc.def.com.53235 > xxxdns.abc.def.com.domain: 6268+ A? kane.wywy.ad.etn.com. (38)

14:41:20.451811 IP esdq0920.abc.def.com.53236 > xxxdns.abc.def.com.domain: 6269+ A? kane.ch.def.com. (33)

P.S. This thread has been moved from HP-UX>General to HP-UX > networking. -HP Forum Moderator

[Dennis Handly]

If you use tusc on each process you might be able to detect this.

[eric_wilford]

You can use the HP-UX tool nettl(1m) to take a network trace and then format it using netfmt with the -N (nice formatting) options. In the meta data of each pack you will see a field called "PID". In 11.31 this is the actual PID of the process that sent the packet. On previous version this is actually a kernel thread ID so you would need to use another tool to map that to a process ID. Of course you would have to look through the trace to find an outbound DNS packet and this only "works" if the process is long enough lived that you can catch it in a "ps" listing taken at the same time as the nettl trace was taken.