Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to find previously resolved hostnames in linux?

I have a host that I can currently not resolve, but I have resolved it earlier and would like to know which ip was resolved to.

share|improve this question

2 Answers 2

I doubt you can do this after the fact. If you use dnsmasq, then you can turn on DNS query logging: the "--log-queries" command line option looks about correct, and I suppose there's a config file option, too.

Looks like BIND can do the same thing, as "queries" is one of the categories valid for a "logging" configuration.

This also sounds somewhat similar to DNS Cache Snooping.

share|improve this answer
    
thank you for the answer, but for what I need it would have had to be a retroactive solution :). but as you mention there is a good chance this it is actually not possible to get what I want. –  Vegard Nov 7 '13 at 18:51
1  
also we can enable query log using rndc querylog on the server where bind service is running.. –  Rahul Patil Nov 8 '13 at 10:09
    
and in windows client it is ipconfig /displaydns but I haven't found similar in linux client machine –  Rahul Patil Nov 8 '13 at 10:10

You can somewhat if the resolved hostname was in A) in the same subnet B) the entry still exists in your ARP cache. arp -a & ip neighbour show.

The ARP cache timeout is maybe two or three times /proc/sys/net/ipv4/route/gc_timeout seconds so not very usefull.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.