is there any command like 'snoop' in solaris to check the dns requests in HP-UX.

[VINU]

hello friends,

is there any command like 'snoop' in solaris to check the dns requests in HP-UX.

regds
vinu

[Robert-Jan Goossens]

Hi Vinu,

Try ethereal.

http://hpux.connect.org.uk/hppd/hpux/Gtk/Applications/ethereal-0.9.15/

Regards,
Robert-Jan

[Jeff Schussele]

Hi Vinu,

Not sure I understand your question fully, but if all you're looking for is packet sniffer software. etherreal is a fine product but it's a 3rd party product.
HP-UX has a built in command called nettl
man nettl for details. Not real difficult to use but can produce a *large* amount of output in a short time period.

Rgds,
Jeff

[Nicolas Dumeige]

Vinu,

You might also consider tcpdump.
It comes with a lot a frontend and interpretation tools.

Cheers

Nicolas

[Bill Hassell]

If all you are looking for are the DNS requests coming into your server, you can signal named to start logging it's activities. The signal is SIGUSR1 (SIGUSR2 to turn off logging). SIGUSR1 will increment the details of DNS logging each time you send it:

kill -SIGUSR1 $(cat /var/run/named.pid)

If you have a very busy nameserver (named is consuming a lot of time), then the logfile /var/tmp/named.run will grow vary rapidly. Usually only a few seconds are needed to find boxes that are slamming your nameserver. Often you'll find commercial backup programs will generate thousands of queries, once for every file). The fix is easy: change the boxes that are running the backup software to look at /etc/hosts first and put the common machine names in that file. Then change /eetc/nsswitch.conf to look at files, then dns and both your DNS server and the backup programs will be much happier.

[Sanjay_6]

Hi,

Try nettl,

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90681/B2355-90681_top.html&con=/hpux/onlinedocs/B2355-90681/00/02/217-con.html&toc=/hpux/onlinedocs/B2355-90681/00/02/217-toc.html&searchterms=nettl&queryid=20040429-092211

Hope this helps.

Regds

[rick jones · Accepted solution]

as mentioned, nettl is the network tracing tool installed by default on HP-UX.

other tools include ethereal and tcpdump - tcpdump is available from www.tcpdump.org, or you can install it from the "HP Internet Express" software from software.hp.com.

further, if you know the PID of the process issuing DNS requests, you could get some idea of what it was doing by running tusc (ftp.cup.hp.com:/dist/networking/tools/) in verbose mode and looking at the system calls. that will also show you if it is say reading /etc/hosts or perhaps even if it is trying NIS or whatnot.

[VINU]

thanks for ur inputs