Name Server Cache

[David Crowe]

What I am looking for is a method of seeing what external addresses have been queried. Such as if someone sends an email to HP.COM is there a way of just seeing that entry and entries like it in the cache or do I need to look at the named_dump.db and remove all of the local information?

A 2nd part to this question is is there a method of removing an entry out of this cache without having to stop and start the named process?

[Kevin Wright]

Not sure I quite understand your first question, but for the second part of clearing the cache, I think you have to stop/start named to do so...

for part one..to look at the cache, look at the db file created from the sigiNT, don't know what you mean by removing local info.

[John Bolene]

Yes, you do have to stop and restart named to clear the cache. A good way is to sig_named kill and then /usr/sbin/named, this causes about a few seconds of DNS outage, most folks will never notice.

Not sure how to tell what external IP's have been referenced.

Curious why you would want to do this, auditors or porn sites?

You can always turn on debug and have the output go to a log and then scan the log. Use sig_named debug 1 to turn on the logging, and sig_named debug 0 to turn it off.

[Sachin Patel · Accepted solution]

Hi David,
If you are using BIND 4.9.7 or BIND 8.X then you can user category "queries" to log all the queries in to the log file. This statment goes in to the named.boot or /etc/named.conf file like

logging {
category queries {default_debug;};
};

Ans 2: On BIND 8.x you can specify cleaning interval for cache

options { cleaning-interval 120;
};
It is 120 minutes.

Sachin