The BIND 9 Administrator Reference Manual e.g. for version 9.14.11 or 9.17.1 states in
- 5.2. CONFIGURATION FILE GRAMMAR
- The
category
Phrasequeries
- The
The query log entry first reports a client object identifier in
@0x<hexadecimal-number>
format.
This term has not been mentioned anywhere else in the ARM, and it's the only mention of any object identifier at all.
It seems not to be related to the client that was sending the query:
- it could be the same for queries from many unrelated IP addresses but
- it could be different for two queries from the same IP address.
For e.g.
@0x123456789abc
- the first half
123456
seems always stay the same - the second half
789abc
changes from time to time.
- the first half
In query log examples it can be 32-bit
@0xffffffff
or 48-bit@0xffffffffffff
.Alan Clegg, in this BIND Logging presentation from October 2019, only describes it through what it is not:
A
@0x
followed by the client object identifier (nothing to do with the client address)
What is it and how is it calculated?
What information can we get out of it?
Why is it logged anyway?