Sponsored Content
Operating Systems Solaris Identify process sending ldap requests to old DNS server Post 302910792 by badoshi on Monday 28th of July 2014 07:32:14 AM
Old 07-28-2014
Thank you for the pointer. I've went down the dtrace path, and found a script that did exactly what i needed:

conntrack DTrace script: connections by process, user and port on Solaris/Opensolaris | Core Networks Techno Blog

produces real-time output like the following, where the last column is the destination:

Code:
      adclient 19607     0    global     45708        88  TCP 10.x.x.x
      adclient 19607     0    global     45707       389  TCP 10.x.x.x
      adclient 19607     0    global     45707       389  TCP 10.x.x.x

Thanks for your assistance, dtrace is something that I should learn how to use, it looks very handy!
 

9 More Discussions You Might Find Interesting

1. IP Networking

DHCP, DNS and LDAP

I have just started learning Unix on Solaris and have been asked to learn DHCP, DNS and LDAP very quick in order to implement them and maintain. Does anyone know how to do this or a decent book that will include all the above three which tells you how to install and maintain. All i have found so... (2 Replies)
Discussion started by: ollyparkhouse
2 Replies

2. Solaris

/etc/nsswitch.conf hosts ldap dns

Hi all Is there any reason to have "hosts ldap dns" as line in /etc/nsswitch.conf ? My understanding is that ldap does not contain any host information..(?) Best regards...Ludwig (1 Reply)
Discussion started by: ludwig
1 Replies

3. UNIX for Advanced & Expert Users

udp sockets of dns requests not showing anywhere...

Dear guys, I am facing the most weird problem I have ever encountered! Ok here is the situation: From my dns query.log file - it is generated using usual bind9 logging: logging { channel query.log { file "/var/log/bind9/query.log" versions 10 size 2m; severity debug 2;... (0 Replies)
Discussion started by: angeloio
0 Replies

4. Web Development

Sending two requests from one link

Hi everybody, Is it possible to have a URL link i.e. <a href=""></a>, which sends out two requests to a site? As an example, I want want to combine these two links. The first link loads files. The second link searches these files. But I want just one link, where went a user clicks on it,... (3 Replies)
Discussion started by: z1dane
3 Replies

5. Solaris

How to Configure DNS bind 9 with Ldap back-end

My environmnet : solaris 10 u 7 sparc To configure DNS bind use Ldap as zone record database, I use bind 9.7.0 and sun directory 5.2 I do follow http://imil.net/docs/Configuring_DNS_zones_with_LDAP.txt and stuck at make install Error from bind log "database: error: unsupported database... (0 Replies)
Discussion started by: tien86
0 Replies

6. UNIX for Advanced & Expert Users

DNS server choice: Windows DNS vs Linux BIND

I'd like to get some opnions on choosing DNS server: Windows DNS vs Linux BIND comparrsion: 1) managment, easy of use 2) Security 3) features 4) peformance 5) ?? I personally prefer Windows DNS server for management, it supports GUI and command line. But I am not sure about security... (2 Replies)
Discussion started by: honglus
2 Replies

7. Shell Programming and Scripting

Direction to create website to process grep and SED requests

hi I am seeking to create a cgi-bin type creation that will allow users browsing the site to be able to run searches that would be a grep command or SED in the backround. I am not sure how to go about this, if you would give me a pointer or direction about what technology i could inform myself... (0 Replies)
Discussion started by: cdc01
0 Replies

8. IP Networking

DNS requests through SSH/443

Anybody know how to force all DNS requests through port 443 or an SSH tunnel such as Putty in Ubuntu 10.4? (2 Replies)
Discussion started by: 3therk1ll
2 Replies

9. Solaris

LDAP Client not connecting to LDAP server

I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful. The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Discussion started by: solaris_1977
9 Replies
NONAMED(8)						      System Manager's Manual							NONAMED(8)

NAME
nonamed - not a name daemon, but acts like one SYNOPSIS
nonamed [-d[level]] [-p port] [-n address[/port]] DESCRIPTION
Nonamed is not an Internet name daemon. When started it immediately tries to find a real name daemon on the local network. If it finds one then it will relay any DNS queries to that name daemon. If it can't find one then it will do its best to answer simple queries using the /etc/hosts table for name to address translation. On startup nonamed broadcasts up to five" simple UDP queries on the local network. This is a somewhat nasty thing to do, because it makes all name servers on the net spring into action to answer the request. The first name server to answer is used by nonamed to answer the queries of its clients. The broadcast search is repeated after an hour to give another name server a chance to be abused. (It is quite normal for a host to use a remote name server. The broadcasts are a bit unfriendly, but they only happen once an hour.) If a real name server is found then nonamed enters "relay mode", passing all queries on. In relay mode the daemon cannot be distinguished from a real DNS name daemon. Nonamed accepts both UDP and TCP queries under Minix-vmd. Under standard Minix only UDP queries are accepted. 256" relayed UDP queries can be outstanding before it forgets where the first one came from. In answer mode nonamed can answer simple DNS queries to translate a host name to an IP address, or an IP address to a host name. Suppose /etc/hosts looks like this: 127.0.0.1 localhost 192.9.200.1 darask.home.cs.vu.nl 192.9.200.2 burask.home.cs.vu.nl Then queries for the host names listed can be answered with the IP addresses to the left of them. If the name can't be found then it is retried with the domain name stripped of, this is because "localhost" is looked up as "localhost.home.cs.vu.nl" in the above example. Reverse lookups are answered with the first hostname on the line with the IP address. UDP queries are immediately answered on startup if the answer can be found in the hosts file. Failure answers, and answers to TCP queries are delayed until it decides that there are no real name servers out there. Nonamed employs several timeouts for efficient operation: If five" broadcasts, two seconds" apart fail to produce a name server on startup then it decides that there are no real name servers around. After 1 hour" it will again look for a name server. (We don't want to hog the same one indefinitely.) If no UDP reply is seen in .ds m1 than a simple probe is sent the name server. If that doesn't provoke an answer in two seconds" then it will look for a new name server. A failing TCP connection will also invoke a search, the TCP connection is then made to the new name server. A client using UDP will retry eventually, a client using TCP will notice nothing but a short delay. The daemon drops back into answer mode if the search fails and it has a hosts file with a "localhost" entry. It waits five minutes" for any action on a TCP stream before the connection is aborted. In answer mode it will generate data with a TTL (time to live) of 1 hour". OPTIONS
The options are only useful when debugging nonamed, although it can be very instructive to watch DNS queries being done. -d[level] Set debugging level to level (a single digit, by default 1.) Debug mode 1 makes nonamed decode and display the DNS queries and replies that it receives, sends and relays. The decoding only handles the common cases. In debug mode 2 it prints tracing information about the internal jobs it executes. In debug mode 3 it core dumps when an error causes it to exit. The debugging level may also be increased by 1 at runtime by sending signal SIGUSR1 or turned off (set to 0) with SIGUSR2. [-p port] Port to use instead of the normal domain port. [-n address[/port]] Use this IP address and port to find a real name server. It can be used to make nonamed relay to another nonamed. (They do not listen to broadcasts, of course.) You can run two daemons on one machine if you choose a new port number for one of them. You can force nonamed out of relay mode by sending it a hangup signal. FILES
/etc/hosts Hosts to address translation table when in answer mode. SEE ALSO
gethostbyname(3), resolver(3), hosts(5), set_net_default(8), boot(8), inetd(8), irdpd(8), rarpd(8). NOTES
You can specify a remote name server in /etc/resolv.conf to circumvent nonamed. But then you lose its talent for automatically finding new name servers when the remote name server becomes unreachable. Don't add a "localhost" entry to the hosts file if there are remote name servers. It makes nonamed drop back in answer mode on a flaky network. BUGS
If you can get a remote nonamed to listen to your name server then you can make it believe anything you want to. You need access to a machine on the same subnet of course. AUTHOR
Kees J. Bot (kjb@cs.vu.nl) NONAMED(8)
All times are GMT -4. The time now is 12:46 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy