2

Is it possible to find previously resolved hostnames in linux?

I have a host that I can currently not resolve, but I have resolved it earlier and would like to know which ip was resolved to.

3

I doubt you can do this after the fact. If you use dnsmasq, then you can turn on DNS query logging: the "--log-queries" command line option looks about correct, and I suppose there's a config file option, too.

Looks like BIND can do the same thing, as "queries" is one of the categories valid for a "logging" configuration.

This also sounds somewhat similar to DNS Cache Snooping.

  • thank you for the answer, but for what I need it would have had to be a retroactive solution :). but as you mention there is a good chance this it is actually not possible to get what I want. – Vegard Nov 7 '13 at 18:51
  • 1
    also we can enable query log using rndc querylog on the server where bind service is running.. – Rahul Patil Nov 8 '13 at 10:09
  • and in windows client it is ipconfig /displaydns but I haven't found similar in linux client machine – Rahul Patil Nov 8 '13 at 10:10
0

You can somewhat if the resolved hostname was in A) in the same subnet B) the entry still exists in your ARP cache. arp -a & ip neighbour show.

The ARP cache timeout is maybe two or three times /proc/sys/net/ipv4/route/gc_timeout seconds so not very usefull.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.