Seeing contents of dynamic update requests

[Bob]

We have a few machines tossing dynamic update requests our way and getting
the standard 'update denied' messages in the logs.  However, I'm having a
hard time tracking down what machines are actually sending these update
requests so I can yell at their owners, since all I know is a source IP and
what zone they're trying to update.. and in the case of many machines behind
a firewall, I have no idea which one it could be.

I've been searching and digging through the docs trying to find a way to get
BIND to log the actual contents of the dynamic update request which might
help me figure out where they are coming from -- IE if it's trying to set an
A record for "nancy.foo.com", thats a big clue :)  I've cranked up the debug
level to no avail.

Any ideas?

-- 

|  Bob Maple  |  [http] burner.com
|
|  When love is gone, there's always justice.  And when justice is gone,
|  there's always force.  And when force is gone, there's always Mom.
|  Hi, Mom!   -Laurie Anderson