Re: DNS calls....

["Keith G. Murphy" <keithmur@mindspring.com>]

Jerzy Miszczyk wrote:
> 
> Hello Jeremy,
> 
> Thank you for the response.
> I am sorry for brief description of the problem. There is no diald
> installed, the system runs straight forward "isdnutils". Something keeps
> the line up. Every few minutes there is a call to a broadcast address and
> port 138, or a call to a DNS server :(. There is no broadcast specified in
> network configuration for ippp0 (my ISDN interface). I would like to be
> able to see "who" initiates" those calls.
> 
Is this a situation where your system is acting as DNS server for a
network, and it is good enough to find the IP address of the
"offender"?  In that case, you could just make your bind do logging. 
Change your /etc/init.d/bind:

        start-stop-daemon --start --quiet --exec /usr/sbin/named -- -d 4
        #start-stop-daemon --start --quiet --exec /usr/sbin/named

Then look for the log in /var/cache/bind/named.run.