[nsd-users] Logfile/verbosity and master/slave

[Stephane Bortzmeyer]

On Wed, Dec 10, 2008 at 10:24:09AM +0100,
 Arnt Gulbrandsen <arnt at gulbrandsen.priv.no> wrote 
 a message of 14 lines which said:

> tcpdump will tell you this, and IMO using tcpdump is better than
> doing it in-server,

I agree that this logging ability should *not* be added to nsd (or
that it can be disabled at compile-time) but do note there are other
tools than tcpdump, specially when you want fine-grain selections of
DNS queries/responses, as requested by the OP. (tcpdump can only
filter by IP addresses, port numbers, not by DNS content.)

I suggest:

tshark <http://www.wireshark.org/docs/man-pages/tshark.html> and its
powerful DNS filter language
<http://www.wireshark.org/docs/dfref/d/dns.html>

dnscap <https://www.dns-oarc.net/tools/dnscap> a pain to compile but 
a very useful tool