Search

Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

You can capture DNS queries and responses for later analysis. When configuring this feature, you can choose to save the capture file locally on your appliance, as well as on the FTP (File Transfer Protocol) or SCP (Secure Copy) server. When you save it locally, you can use show query_capture to view the contents of the capture file. You can also use filter commands to exclude certain queries and view only the desired ones. Note that using multiple CLI commands to filter data for the appliances with large number of captured DNS queries and responses can significantly affect the system performance, protocol performance, and CLI command performance. For more information about CLI commands, refer to the Infoblox CLI Guide.

Note
titleNote

...

The DNS queries and responses captured on an IB-4030 appliance does not contain cached query information.


A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. The capture file is automatically saved and exported to an FTP or SCP server based on your configuration. When you configure the appliance to save the capture file locally and later enable FTP or SCP, the appliance copies all the data starting with the oldest data. Infoblox recommends that you constantly monitor the FTP or SCP server to ensure that it has sufficient disk space. DNS queries and responses are stored on the appliance if the FTP or SCP server becomes unreachable. The maximum storage capacity varies based on the appliance model. After reaching the maximum limit, the appliance overwrites the old data with the new one. For information about the maximum hard drive space, see the table below. The amount of data captured depends on the DNS query rate and the domains that are included in or excluded from the capture. For information about how to exclude domains, see Excluding Domains From Query and Response Capture.

...

  1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
    Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
  2. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Advanced Mode and select the Logging tab.
  3. Under Data Collection for all DNS Queries/Responses to a Domain, complete the following:
    • Select the Capture DNS Queries check box to start capturing DNS queries. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS queries for the selected members only.
    • Select the Capture DNS Responses check box to start capturing DNS responses. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS responses for the selected members only.
Note
titleNote

...

Enabling the logging of queries and responses at the same time can increase disk space usage and adversely affect DNS services and performance. Infoblox recommends that you do not configure both logging at the same time.


    • Select Capture queries/responses for all domains to capture queries and responses to all domains and zones.
    • Select Limit capture to these domains to capture DNS queries and responses to domains and zones one at a time.
    • Specify domains for DNS capture operations in the Domain table by clicking the Add icon, and choosing Add Domain or Bulk Add Domains from the menu.
    • To define the destination for capture files, do the following:
      • Retain captured queries on the local disk: Select this check box to save the DNS queries on the appliance. In addition to the local disk, you can select to export the DNS queries to the remote server by selecting SCP in the Export to drop-down list.
      • Export to: From the drop-down list, select SCP to back up the DNS queries on the remote server and None to save queries only on the appliance. To save the captured DNS queries on both the appliance and the remote server, select the Retain captured queries on the local disk check box and SCP from the Export to drop-down list.
Note
titleNote

...

When you configure an SCP server and enable the MGMT port, the NIOS appliance uses SSH for data transfer. It uses the same authentication and provides the same security as SSH. SCP uses the LAN1 port to communicate with the external servers.


    • When you select FTP or SCP from the Export to drop-down list, complete the following:
      • In the Directory Path field, enter the directory to which the capture file will be saved on the server. Infoblox recommends that you use the ~ symbol for the remote server.
      • In the Server Address field, enter the IP address of the remote server to which the capture files will be saved.
      • Enter the file server account Username and Password values.
    • Limit query data collected per file to minutes or 100MB (whichever comes first): This option limits the collection of query data per capture file. A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. You can enter a value from 1 to 10.

...

You can exclude individual domains and their subdomains from DNS query and response capturing. You can also use the Bulk Add Domains feature for a subset of domains to exclude them from query and response capturing.
Subdomains can also be specified for exclusion. NIOS matches the specified domain names and their subdomains while filtering them in the Exclusion list. For example, when you specify 'foo.com' as the domain to be excluded, NIOS filters queries for 'foo.com,' 'mail.foo.com,' and 'ftp.foo.com.'

Note
titleNote

...

IDNs are not supported for the domains that are added to the Inclusion list and Exclusion list. You can use the punycode representation of an IDN in these lists.


To exclude a domain from query and response capturing, do the following:

  1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
    Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
  2. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Advanced Mode and select the Logging tab.
  3. Under Data Collection for all DNS Queries/Responses to a Domain, select the Exclude the following domains check box.
  4. Click the Add icon and select Add Domain or Bulk Add Domains and specify domains in the Domain table.
Note
titleNote

...

NIOS first matches the domains in the Exclusion list and then matches the domains in the Inclusion list. NIOS does not capture queries and responses for the subdomains in

...

the Capture DNS Queries/Responses

...

 list (Inclusion list) if their domains are added to

...

the Exclude the following domains list (Exclusion list).


The following table provides examples of domains and subdomains added to the Inclusion and Exclusion lists and the corresponding effects on the query and response capture operations:

...