--- title: "Capturing DNS Queries and Responses" canonical: "https://docs.infoblox.com/space/NAG8/22252254/Capturing%20DNS%20Queries%20and%20Responses" format: markdown --- You can capture DNS queries and responses for later analysis. When configuring this feature, you can choose to save the capture file locally on your appliance, as well as on the FTP (File Transfer Protocol) or SCP (Secure Copy) server. When you save it locally, you can use show query_capture to view the contents of the capture file. You can also use filter commands to exclude certain queries and view only the desired ones. Note that using multiple CLI commands to filter data for the appliances with large number of captured DNS queries and responses can significantly affect the system performance, protocol performance, and CLI command performance. For more information about CLI commands, refer to the *Infoblox* *CLI* *Guide*. --- **Note:** The DNS queries and responses captured on an IB-4030 appliance does not contain cached query information. --- A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. The capture file is automatically saved and exported to an FTP or SCP server based on your configuration. When you configure the appliance to save the capture file locally and later enable FTP or SCP, the appliance copies all the data starting with the oldest data. Infoblox recommends that you constantly monitor the FTP or SCP server to ensure that it has sufficient disk space. DNS queries and responses are stored on the appliance if the FTP or SCP server becomes unreachable. The maximum storage capacity varies based on the appliance model. After reaching the maximum limit, the appliance overwrites the old data with the new one. For information about the maximum hard drive space, see the table Maximum Hard Drive Space used for DNS queries and Responses below. The amount of data captured depends on the DNS query rate and the domains that are included in or excluded from the capture. For information about how to exclude domains, see Excluding Domains From Query and Response Capture below. # Capturing DNS Queries You can capture queries to all domains or limit the capture to specific domains. You can also apply the Bulk Add Domains feature to tailor query capture to a desired subset of domains or zones. When capturing DNS queries, NIOS matches the specified domain name(s) and everything that belongs to the domain. For example, when you specify 'foo.com' as the domain, NIOS captures queries sent to 'foo.com,' 'mail.foo.com,' and 'ftp.foo.com.' NIOS captures queries to domains for which a name server is authoritative; it also captures recursive queries. Note that this feature does not support wildcard characters or regular expressions. ## DNS Query Message Format The DNS query generates a query message in the following format: ` # query: <- or +>[SETDC] <(name server ip)>` where `+ = recursion` `- = no recursion` `S = TSIG` `E = EDNS option set` `T = TCP query` `D = EDNS ‘DO’ flag set` `C = ‘CD’ message flag set` Following is a sample DNS query message: `30-Apr-2013 13:35:02.187 client 10.120.20.32#42386: query: foo.com IN A + (100.90.80.102)` # Capturing DNS Responses You can capture DNS responses for the DNS queries sent to the server. The amount of data captured depends on the domains that are included in or excluded from the capture. A DNS response is based on a query generated for a domain. In the response message, NIOS captures the TTL value of a resource record, the resource record type, and resource data. Following are characteristics of the response messages: - They log only the answer section and do not include the authority and additional sections. - Responses to all queries are logged, including queries with the type "ANY." - The RR (resource record) list is not available at the end of a response message if rcode has a value other than NOERROR or if the response is NOERROR (nodata). - Responses to all RR types, including those records not managed by NIOS such as HINFO records, are logged. However, there are few exceptions for some of the scenarios with DNSSEC records. - Responses containing DNSSEC RRs (DNSKEY, DS, NSEC, NSEC3, NSEC3PARAM, RRSIG) when queried for non-DNSSEC RRs are not logged. However, responses are logged if a DNSSEC RR is explicitly queried. - DNS updates are not logged in responses. ## DNS Response Message Format and Examples The DNS query generates a response message in the following format: ` client #port : [view: DNS view] query: response: [; [;] ...]` `Flags = <- or +>[ATEDVL]` where `- = recursion not available` `+ = recursion available (from DNS message header)` `A = authoritative answer (from DNS message header)` `t = truncated response (from DNS message header)` `E = EDNS OPT record present (from DNS message header)` `D = DNSSEC OK (from EDNS OPT RR)` `V = responding server has validated DNSSEC records` `L = response contains DTC synthetic record` Following are some DNS response samples: **Example 1:** **When querying an** **A** **record** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a2.foo.com IN A response: NOERROR +AED a2.foo.com. 28800 IN A 1.1.1.2;` **Example 2:** **When querying an** **AAAA record** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a4.foo.com IN AAAA response: NOERROR +AED a4.foo.com. 28800 IN AAAA ab::a;` **Example 3:** **When querying an** **A** **record** **over IPv6** `07-Apr-2013 20:16:49.083 client 2001::2#57398 UDP: query: a2.foo.com IN A response: NOERROR +AED a2.foo.com. 28800 IN A 1.1.1.2;` **Example 4:** **When querying an** **A** **record** **over TCP** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 TCP: query: a2.foo.com IN A response: NOERROR +ED a2.foo.com. 28800 IN A 1.1.1.2;` **Example 5:** **When querying ANY record** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a2.foo.com IN ANY response: NOERROR +ED a2.foo.com. 28800 IN A 1.1.1.2;` **Example 6:** **When querying an** **A** **record** **with multiple addresses** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a1.foo.com IN A response: NOERROR +ED a1.foo.com. 28800 IN A 1.1.1.1; a1.foo.com. 28800 IN A 11.1.1.1;` **Example 7:** **When querying an** **aliased** **A** **record** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: c2.foo.com IN A response: NOERROR +ED c2.foo.com. 28800 IN CNAME a2.foo.com.; a2.foo.com. 28800 IN A 1.1.1.2;` **Example 8:** **When querying an** **NXDOMAIN** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: non-exist.foo.com IN A response: NXDOMAIN +ED` **Example 9:** **Response** **message** **for NOERROR/nodata** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a1.foo.com IN SRV response: NOERROR +ED` **Example 10:** **Response message for refused query** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: refused.com IN A response: REFUSED +ED` **Example 11:** **Response message when server fails** `07-Apr-2013 20:16:49.083 client 10.120.20.198#12345 UDP: query: servfail.com IN A response: SERVFAIL +E` **Example 12:** **Response message when query A record in** **a** **signed** **zone** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a1.signed.com IN A response: NOERROR +ED a1.signed.com. 28800 IN A 1.1.1.1;` **Example 13:** **Response message for explicit query to DNSSEC RRs** `07-Apr-2013 20:16:49.083 client 10.120.20.198#57398 UDP: query: a1.signed.com IN RRSIG response: NOERROR +ED a1.signed.com. 28800 IN RRSIG A 5 3 28800 20130616004903 20130611234903` ` 4521 signed.com. evROKe7RbnkjFTsumT3JJg76bduFLfdEEnszitXHQCbVYBS5rDy+qbUI HCQuN/ldCNTJbZQ8MEhuatzfms+2Y5K2sU67P9Yg6GkOMxsT2LcJiBm/ YqrYiZBWGKpLF6J0PdX05133Xwq8XxUStUEJxKfuzcKSY6jaSduQIdFL v6A=; a1.signed.com.900 IN RRSIG NSEC 5 3 900 20130616004903 20130611234903 4521 signed.com.` ` CnFmXMx9D+ZkDsztQbW2xx8XCROGNMBp0baxFXS/Pxxhg4PQcq58laI97y2Xgqswn/wKNhY8p9hkes5+6t/ihCOIbw FryxtdivPfYYFf3jafedFN ymZu05K9bYUfCUzZTGiRzoJYhxBM7xFT8fMvxni9ngsbLym82Tqv3Nua 6wU=;` # Configuring DNS Query and Response Captures To configure DNS query and response captures: 1. **Grid**: From the **Data** **Management** tab, select the **DNS** tab, expand the **Toolbar** and click **Grid** **DNS** **Properties**. **Member**: From the **Data** **Management** tab, select the **DNS** tab and click the **Members** tab -> *member* check box -> Edit icon. 2. In the *Grid* *DNS* *Properties* or *Member* *DNS* *Properties* editor, click **Toggle** **Advanced** **Mode** and select the **Logging** tab. 3. Under **Data connector** **for** **all** **DNS** **Queries/Responses** **to** **a** **Domain**, complete the following: - Select the **Capture** **DNS** **Queries** check box to start capturing DNS queries. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS queries for the selected members only. - Select the **Capture** **DNS** **Responses** check box to start capturing DNS responses. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS responses for the selected members only. **Note:** Enabling the logging of queries and responses at the same time can increase disk space usage and adversely affect DNS services and performance. Infoblox recommends that you do not configure both logging at the same time. - Select **Capture** **queries/responses** **for** **all** **domains** to capture queries and responses to all domains and zones. - Select **Limit** ** capture** ** to** ** these ** **domains** to capture DNS queries and responses to domains and zones one at a time. - Specify domains for DNS capture operations in the Domain table by clicking the Add icon, and choosing **Add** ** Domain** or **Bulk** ** Add** ** Domains** from the menu. - To define the destination for capture files, do the following: - **Retain** ** captured** ** queries** ** on** ** the** ** local ** **disk**: Select this check box to save the DNS queries on the appliance. In addition to the local disk, you can select to export the DNS queries to the remote server by selecting **SCP** in the **Export ** **to** drop-down list. - **Export** ** to:** From the drop-down list, select **SCP** to back up the DNS queries on the remote server and **None** to save queries only on the appliance. To save the captured DNS queries on both the appliance and the remote server, select the **Retain** ** captured** ** queries** ** on ** **the ** **local** ** disk** check box and **SCP** from the **Export** ** to** drop-down list. **Note:** When you configure an SCP server and enable the MGMT port, the NIOS appliance uses SSH for data transfer. It uses the same authentication and provides the same security as SSH. SCP uses the LAN1 port to communicate with the external servers. - When you select **FTP** or **SCP** from the **Export** **to** drop-down list, complete the following: - In the **Directory** **Path** field, enter the directory to which the capture file will be saved on the server. Infoblox recommends that you use the ~ symbol for the remote server. - In the **Server** **Address** field, enter the IP address of the remote server to which the capture files will be saved. - Enter the file server account **Username** and **Password** values. - **Limit** **query** **data** **collected** **per** **file** **to** **minutes** **or** **100MB** **(whichever** **comes** **first)**: This option limits the collection of query data per capture file. A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. You can enter a value from 1 to 10. 4. Save the configuration. The following table 37.2 lists the maximum hard drive space required for capturing DNS queries and responses for supported Infoblox appliance models.  *Table* *37.2* *Maximum* *Hard* *Drive* *Space* *used* *for* *DNS* *queries* *and* *Responses* | **Supported**** ****Infoblox**** ****Appliances** | **Maximum**** ****Hard**** ****Drive**** ****Space**** ****for**** ****DNS**** ****Query**** ****/Response**** ****Capture**** ****(MB)** | | --- | --- | | Trinzic 100 | 400 | | Trinzic 810 | 900 | | Trinzic 815 and IB-V815 | 900 | | Trinzic 820 | 3100 | | Trinzic 825 and IB-V825 | 3100 | | Trinzic 1410 | 6000 | | Trinzic 1415 and IB-V1415 | 6000 | | Trinzic 1420 | 10000 | | Trinzic 1425 and IB-V1425 | 10000 | | Trinzic 2210 | 12000 | | Trinzic 2215 and IB-V2215 | 12000 | | Trinzic 2220 | 28000 | | Trinzic 2225 and IB-V2225 | 28000 | | Infoblox-4010 | 40000 | | IB-VM-100 | 400 | | IB-VM-2000 (120G) | 15000 | | IB-VM-810 (120G) | 900 | | IB-VM-820 | 3100 | | IB-VM-1410 (120G) | 6000 | | IB-VM-1420 (120G) | 10000 | | IB-VM-2210 (120G) | 12000 | | IB-VM-2220 (120G) | 28000 | | IB-VM-4010 (120G) | 40000 | | PT-1400 | 10000 | | PT-1405 | 10000 | | PT-2200 | 28000 | | PT-2205 | 28000 | | PT-4000 | 40000 | # Excluding Domains From Query and Response Capture You can exclude individual domains and their subdomains from DNS query and response capturing. You can also use the Bulk Add Domains feature for a subset of domains to exclude them from query and response capturing. Subdomains can also be specified for exclusion. NIOS matches the specified domain names and their subdomains while filtering them in the Exclusion list. For example, when you specify 'foo.com' as the domain to be excluded, NIOS filters queries for 'foo.com,' 'mail.foo.com,' and 'ftp.foo.com.' --- **Note:** IDNs are not supported for the domains that are added to the Inclusion list and Exclusion list. You can use the punycode representation of an IDN in these lists. --- To exclude a domain from query and response capturing, do the following: 1. **Grid**: From the **Data** **Management** tab, select the **DNS** tab, expand the **Toolbar** and click **Grid** **DNS** **Properties**. **Member**: From the **Data** **Management** tab, select the **DNS** tab and click the **Members** tab -> *member* check box -> Edit icon. 2. In the *Grid* *DNS* *Properties* or *Member* *DNS* *Properties* editor, click **Toggle** **Advanced** **Mode** and select the **Logging** tab. 3. Under **Data connector** **for** **all** **DNS** **Queries/Responses** **to** **a** **Domain**, select the **Exclude** **the** **following** **domains** check box. 4. Click the Add icon and select **Add** **Domain** or **Bulk** **Add** **Domains** and specify domains in the Domain table. --- **Note:** NIOS first matches the domains in the Exclusion list and then matches the domains in the Inclusion list. NIOS does not capture queries and responses for the subdomains in the **Capture** **DNS** **Queries/Responses** list (Inclusion list) if their domains are added to the **Exclude** **the** **following** **domains** **list** (Exclusion list). --- The following table provides examples of domains and subdomains added to the Inclusion and Exclusion lists and the corresponding effects on the query and response capture operations: | **Capture**** ****DNS**** ****Queries/**** ****Responses**** ** **(Inclusion**** ****List)** | **Exclude**** ****the**** ****following**** ****domains**** ****(Exclusion**** ****List)** | **Queried**** ****Domain** | **Queries/**** ****Responses**** ****Captured** | **Results** | | --- | --- | --- | --- | --- | | foo.com | – | - foo.com - finance.foo.com | Yes | Exclusion list is empty and therefore matches the Inclusion list. NIOS captures queries/responses made to foo.com and finance.foo.com | | | – | - corp1.com | No | NIOS does not capture queries/responses made to corp1.com as this domain is not mentioned in the Inclusion list. | | Capture All | foo.com | - foo.com | No | Matches the Exclusion list and NIOS does not capture queries made to foo.com. | | | | - finance.foo.com | No | Subdomain matches the Exclusion list and NIOS does not capture queries/responses made to finance.foo.com. | | | | - corp1.com | Yes | Does not match the Exclusion list. Matches the Inclusion list and therefore NIOS captures queries/responses made to corp1.com. | | foo.com | it.foo.com | - foo.com - finance.foo.com | Yes | Does not match the Exclusion list and therefore NIOS captures queries/responses made to foo.com and finance.foo.com. | | | | - it.foo.com - ms.it.foo.com | No | Matches the Exclusion list and excludes their subdomains. NIOS does not capture queries/responses made to it.foo.com and ms.it.foo.com. | | it.foo.com | foo.com | | | Domain is added to the Exclusion list and its subdomain is added to the Inclusion list. Therefore, this is not a valid configuration as queries/responses are not captured. The appliance displays a warning message for such invalid configuration. | | it.foo.com | it.foo.com | | | Domain is added to both the Exclusion and Inclusion lists. This is not a valid configuration as queries/responses are not captured. The appliance displays a warning message for such invalid configuration. | | foo.com | corp1.com | | | Domain added to the Inclusion list is not the subdomain of the domain added to the Exclusion list. This is a redundant configuration as the outcome is the same even if the domain is removed from the Exclusion list. The appliance displays a warning message for such invalid configuration. |