The BIND 9 Administrator Reference Manual e.g. for version 9.14.11 or 9.17.1 states in

    • The category Phrase
      • queries

The query log entry first reports a client object identifier in @0x<hexadecimal-number> format.

This term has not been mentioned anywhere else in the ARM, and it's the only mention of any object identifier at all.

  • It seems not to be related to the client that was sending the query:

    • it could be the same for queries from many unrelated IP addresses but
    • it could be different for two queries from the same IP address.
  • For e.g. @0x123456789abc

    • the first half 123456 seems always stay the same
    • the second half 789abc changes from time to time.
  • In query log examples it can be 32-bit @0xffffffff or 48-bit @0xffffffffffff.

  • Alan Clegg, in this BIND Logging presentation from October 2019, only describes it through what it is not:

    A @0x followed by the client object identifier (nothing to do with the client address)

What is it and how is it calculated?
What information can we get out of it? Why is it logged anyway?

1 Answer 1


According to Tony Finch's reply to bind-users mailing list in August 2019:

It's the address in memory of the data structure BIND uses to hold its working state for the query.

I'm surprised this seems the only place this is actually explained. The naming seems rather misleading as, based on this, it's not about the client nor object identifiers OID (per ITU-T X.660 | ISO/IEC 9834-1).

The explanation seems credible, as it's coherent with both the format and behaviour of the value. This logging comes from ISC's lib/ns/client.c i.e. the client object (Thanks, Patrick Mevzek!):

2715    isc_log_write(ns_lctx, category, module, level,
2716              "client @%p %s%s%s%s%s%s%s%s: %s", client, peerbuf, sep1,
2717              signer, sep2, qname, sep3, sep4, viewname, msgbuf);

Here, the %p indeed is the memory address (pointer) of the client, as it's written in C, and the "client @%p %s%s%s%s%s%s%s%s: %s" is a printf format string, where the % placeholder has:

The syntax for a format placeholder is


Type field

  • s: null-terminated string.
  • p: void * (pointer to void) in an implementation-defined format.

Instead, the BIND 9 Administrator Reference Manual COULD simply say something like:

The query log entry first reports the memory address of the data scructure used to hold the working state for the query, in @0x<hexadecimal-number> format.

Well, the whole paragraph could also be formatted as a list instead of a story...

  • 1
    I am not 100% sure but it may be that the log comes from gitlab.isc.org/isc-projects/bind9/-/blob/master/lib/ns/… ; it has @%p (a format that appears in a lot of other places), and it is a client variable injected to it, so indeed should yield a pointer to some structure allocated for the specific client handled there. May 17, 2020 at 23:27
  • 1
    The @ is just literally the character @ on the string, and the %p refers to the pointer address as a placeholder in a printf format string in C. I've added this to my answer. May 30, 2020 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .