9

I'm running two bind servers a activated query logging but don't know what exactly i see here and not finding anything on the web which enlightens me;

31-Oct-2017 17:56:35.464 queries: client x.x.x.x#55638: query: test.example.com IN A +
31-Oct-2017 17:56:35.464 queries: client x.x.x.x#55638: query: test.example.com IN A +
31-Oct-2017 16:34:07.505 queries: client x.x.x.x#2968: query: test.example.com IN A -ED
31-Oct-2017 16:45:23.316 queries: client x.x.x.x#36192: query: test.example.com IN A -EDC
31-Oct-2017 18:02:12.711 queries: client x.x.x.x#37001: query: test.example.com IN A +E

At the end of the lines A-, A+, -E, +E, -ED, -EDC is what i try to understand;

1 Answer 1

14

This is documented in the BIND Administrator Reference Manual and source tarball.

From the ICS webpage;

The query log entry first reports a client object identifier in @0x format. Next, it reports the client's IP address and port number, and the query name, class and type. Next, it reports whether the Recursion Desired flag was set (+ if set, - if not set), if the query was signed (S), EDNS was in used along with the EDNS version number (E(#)), if TCP was used (T), if DO(DNSSEC Ok) was set (D), if CD (Checking Disabled) was set (C), if a valid DNS Server COOKIE was received (V), or if a DNS COOKIE option without a valid Server COOKIE was present (K). After this the destination address the query was sent to is reported. Note: This reflects BIND 9.11.0 behaviour.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .