1

I have an A record in the DNS server which points to my server IP. Noted that I have multiple domain names which points to the same server too.

Now I need to know, which IPs send a request to this specific domain name? pbx.mywebsite.com

How can I figure it out?

  • can you explain the context to which this applies (web service, ssh, ... ?) – tonioc Jan 14 '18 at 9:56
  • @tonioc Not sure what you mean exactly, but it's all about a website, so I guess the answer is web service. – stack Jan 14 '18 at 10:50
1

You can monitor the requests at several points of your infra-structure.

If your intentions are knowing who made the DNS requests, you can configure and activate BIND logs temporarily to log queries requests. At the BIND server, you can also run dnscap or tcpdump

If you want to know who accessed the site, you can see the web server request logs, or use tcpdump at the web server side.

In BIND to activate query logs, the syntax is:

logging {

    channel querylog{
        file "/var/log/querylog";
        severity debug 10;
        print-category yes;
        print-time yes;
        print-severity yes;
        };
        category queries { querylog;}; 
     };
};
  • I got the whole of your answer except the last sentence. What's that code snippet? I hardly think it is a command :-) .. So how can I execute it? what language is it? What does it do? – stack Jan 14 '18 at 12:36
  • If you run your own DNS/BIND server for that domain, you include it inside the options { }section for it to log all the queries done in a file, and then you grep it for your queries. Otherwise, ignore it. – Rui F Ribeiro Jan 14 '18 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.