How can I monitor requested IPs to a specific domain?

Question

I have an A record in the DNS server which points to my server IP. Noted that I have multiple domain names which points to the same server too.

Now I need to know, which IPs send a request to this specific domain name? pbx.mywebsite.com

How can I figure it out?

Answer 1

You can monitor the requests at several points of your infra-structure.

If your intentions are knowing who made the DNS requests, you can configure and activate BIND logs temporarily to log queries requests. At the BIND server, you can also run dnscap or tcpdump

If you want to know who accessed the site, you can see the web server request logs, or use tcpdump at the web server side.

In BIND to activate query logs, the syntax is:

logging {

    channel querylog{
        file "/var/log/querylog";
        severity debug 10;
        print-category yes;
        print-time yes;
        print-severity yes;
        };
        category queries { querylog;}; 
     };
};