2

I currently setup my network to do all DNS through our 2003 Server, and now that there is a Cache, I'd like to pull some reports on it. I am a .NET developer and my idea is to parse a file and dump it into SQL Server.

The problem is that I don't know where Server stores the Cache. Can anyone lead me in the right direction?

Improve this question

3 Answers 3

Reset to default
2

I believe it is all in memory.

I know you can use the dnscmd to dump the cache with a command like this:

dnscmd serverip /zoneprint .

You can view the contents of the with the DNS MMC. From the View menu make sure the 'Advanced' option is checked. You can then click on a server and under that will be a folder named 'Cached Lookups'.

There will be a performance cost, but what you may actually want to do is enable the debug logging and then run reports against the log file, instead of trying to look at the at just the cache.

To configure debug logging open up the DNS manager, right click on the server. There is a tab 'Debug Logging'. Set the path for the log file and check the boxes to log what you want to see.

Improve this answer
7
  • which debug logging are you referring to? My ultimate goal is to see all HTTP requests going through my network. I figure since my server serves the DNS that this would be the logical spot. I'm open to alternitaves...
    – Chase Florell
    Oct 21, 2009 at 22:44
  • oh, and also, evidently I do not have dnscmd on my server.
    – Chase Florell
    Oct 21, 2009 at 22:45
  • I am pretty sure you get dnscmd as part of the resource kit (microsoft.com/Downloads/…)
    – Zoredache
    Oct 21, 2009 at 22:47
  • If I wanted to build reports based on HTTP requests, I personally would setup a proxy like squid. I would force my clients through it by setting it up transparently, or distributing proxy settings via GPO. Then I would use one of the many reporting tools designed for that (sarg, calamaris, etc...)
    – Zoredache
    Oct 21, 2009 at 22:49
  • Well I just took a quick look at Squid and it's far more work than I'm willing to put in.. but thanks.
    – Chase Florell
    Oct 21, 2009 at 23:26
1

If you need to look at http requests only, you'll have to use some sort of proxy or other network tool.

You could configure a server to be the gateway router and use a tool like Wireshark to analyze the traffic.

Another option is to use a feature of some managed network switches called port mirroring. You can mirror the traffic of the port of your existing gateway router to the port of another machine and use Wireshark to capture the data.

Improve this answer
2
  • I took a quick look at Wireshark, but mirroring the router seems complicated.
    – Chase Florell
    Oct 22, 2009 at 1:36
  • also, this is just a home network, so my router is consumer grade (Dlink DIR-825)
    – Chase Florell
    Oct 22, 2009 at 1:39
0

I believe the cache exists only in memory since the records in the cache are transient and will expire based on the TTL of the records. Anyone know anything different?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.