Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently setup my network to do all DNS through our 2003 Server, and now that there is a Cache, I'd like to pull some reports on it. I am a .NET developer and my idea is to parse a file and dump it into SQL Server.

The problem is that I don't know where Server stores the Cache. Can anyone lead me in the right direction?

share|improve this question
up vote 2 down vote accepted

I believe it is all in memory.

I know you can use the dnscmd to dump the cache with a command like this:

dnscmd serverip /zoneprint .

You can view the contents of the with the DNS MMC. From the View menu make sure the 'Advanced' option is checked. You can then click on a server and under that will be a folder named 'Cached Lookups'.

There will be a performance cost, but what you may actually want to do is enable the debug logging and then run reports against the log file, instead of trying to look at the at just the cache.

To configure debug logging open up the DNS manager, right click on the server. There is a tab 'Debug Logging'. Set the path for the log file and check the boxes to log what you want to see.

share|improve this answer
which debug logging are you referring to? My ultimate goal is to see all HTTP requests going through my network. I figure since my server serves the DNS that this would be the logical spot. I'm open to alternitaves... – Chase Florell Oct 21 '09 at 22:44
oh, and also, evidently I do not have dnscmd on my server. – Chase Florell Oct 21 '09 at 22:45
I am pretty sure you get dnscmd as part of the resource kit (…) – Zoredache Oct 21 '09 at 22:47
If I wanted to build reports based on HTTP requests, I personally would setup a proxy like squid. I would force my clients through it by setting it up transparently, or distributing proxy settings via GPO. Then I would use one of the many reporting tools designed for that (sarg, calamaris, etc...) – Zoredache Oct 21 '09 at 22:49
Well I just took a quick look at Squid and it's far more work than I'm willing to put in.. but thanks. – Chase Florell Oct 21 '09 at 23:26

If you need to look at http requests only, you'll have to use some sort of proxy or other network tool.

You could configure a server to be the gateway router and use a tool like Wireshark to analyze the traffic.

Another option is to use a feature of some managed network switches called port mirroring. You can mirror the traffic of the port of your existing gateway router to the port of another machine and use Wireshark to capture the data.

share|improve this answer
I took a quick look at Wireshark, but mirroring the router seems complicated. – Chase Florell Oct 22 '09 at 1:36
also, this is just a home network, so my router is consumer grade (Dlink DIR-825) – Chase Florell Oct 22 '09 at 1:39

I believe the cache exists only in memory since the records in the cache are transient and will expire based on the TTL of the records. Anyone know anything different?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.