logging forwarding reqs

[Sam Wilson]

In article <mailman.1172.1271358692.21153.bind-users at lists.isc.org>,
 Gregory Hicks <ghicks at hicks-net.net> wrote:

> > Date: Thu, 15 Apr 2010 14:25:35 -0400
> > Subject: Re: logging forwarding reqs
> > From: Jonathan Reed <jreed777 at gmail.com>
> > To: bind-users at lists.isc.org
> > 
> > But I am still unable to determine if those reqs are asking the
> > forwarders.
> >
> > The forwarders are all Windows boxes which I dont have rights to
> > access.  Still hoping there is something within bind9 that can say
> > the req went to fwd'er.
> 
> Since you don't have access to the Windows boxen, it seems to me that
> this is a candidate for the "old sniff the firewall" trick.
> 
> Sniff the DNS traffic on the internal facing connection of your
> firewall (you DO have a firewall, don't you?) and see which IP
> addresses the DNS requests are originating from.  If from your Windows
> boxen, then the forwarding is working correctly.  (You ARE getting dns
> requests resolved on the non-windows clients are you not?)
> 
> If not from the Windows boxen, then there is an error in your setup.

Simpler yet, sniff the resolving server and see if it's getting its 
answers from the Windows boxes.

Sam