[CentOS] how do I find out which nameserver returns a DNS query?

nate centos at linuxpowered.net
Mon Jul 7 18:37:16 UTC 2008

Ken Price wrote:

> Hmm.  As far as I know, the only place you can find that information
> is on the caching DNS server responding to your queries.  If you want
> those details, setup your own recursive name server and enable verbose
> logging.
> Anyone else with ideas?

Run tcpdump on the client machine and see which system sends a reply?

$ host www.nasa.gov
www.nasa.gov is an alias for www.nasa.gov.speedera.net.
www.nasa.gov.speedera.net is an alias for www.nasa.gov.edgesuite.net.
www.nasa.gov.edgesuite.net is an alias for a1718.x.akamai.net.
a1718.x.akamai.net has address
a1718.x.akamai.net has address

# tcpdump -i eth0 -n port 53 | grep nasa
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:35:22.345956 IP >  55994 [1au] A?
www.nasa.gov. (41)
11:35:22.384898 IP >  5495 [1au] A?
www.nasa.gov. (41)
11:35:22.480205 IP >  34592 [1au] A?
www.nasa.gov.speedera.net. (54)
11:35:22.582535 IP >  42385 [1au] A?
www.nasa.gov.speedera.net. (54)
11:35:22.619921 IP >  42385 A?
www.nasa.gov.speedera.net. (43)
11:35:22.692525 IP >  27350 [1au] A?
www.nasa.gov.edgesuite.net. (55)
11:35:22.797816 IP >  27350 A?
www.nasa.gov.edgesuite.net. (44)

My internal name server forces the source port to be 53, so you may not
want to use the port 53 option if your source port is random.


More information about the CentOS mailing list