[v9_11] store local and remote addresses in dnstap

4569.	[func]		Store both local and remote addresses in dnstap
			logging, and modify dnstap-read output format to
			print them. [RT #43595]

(cherry picked from commit 650b5e7592be43d6994ba425bc1fa654d538cd7e)

diff --git a/CHANGES b/CHANGES
index 27d36e92c083791110128d5c2c956936d763b1cf..9e37690005cb74a353cc85e62f81c37a41a2997c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4569.  [func]          Store both local and remote addresses in dnstap
+                       logging, and modify dnstap-read output format to
+                       print them. [RT #43595]
+
 4568.  [contrib]       Added a --with-bind option to the dnsperf configure
                        script to specify BIND prefix path.
 

diff --git a/bin/named/client.c b/bin/named/client.c
index 89721a7e7d5e66575bda3b3ecebde39a5ca426ed..404a25a6d1f9b94ea30c6fafa87f9658d2234c67 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1188,12 +1188,12 @@ client_send(ns_client_t *client) {
                isc_buffer_usedregion(&buffer, &r);
                isc_buffer_putuint16(&tcpbuffer, (isc_uint16_t) r.length);
                isc_buffer_add(&tcpbuffer, r.length);
-
 #ifdef HAVE_DNSTAP
                if (client->view != NULL) {
                        dns_dt_send(client->view, dtmsgtype,
-                                   &client->peeraddr, ISC_TRUE, &zr,
-                                   &client->requesttime, NULL, &buffer);
+                                   &client->peeraddr, &client->interface->addr,
+                                   ISC_TRUE, &zr, &client->requesttime, NULL,
+                                   &buffer);
                }
 #endif /* HAVE_DNSTAP */
 
@@ -1217,11 +1217,12 @@ client_send(ns_client_t *client) {
        } else {
                respsize = isc_buffer_usedlength(&buffer);
                result = client_sendpkg(client, &buffer);
-
 #ifdef HAVE_DNSTAP
                if (client->view != NULL) {
                        dns_dt_send(client->view, dtmsgtype,
-                                   &client->peeraddr, ISC_FALSE, &zr,
+                                   &client->peeraddr,
+                                   &client->interface->addr,
+                                   ISC_FALSE, &zr,
                                    &client->requesttime, NULL, &buffer);
                }
 #endif /* HAVE_DNSTAP */
@@ -2784,7 +2785,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
                        dtmsgtype = DNS_DTTYPE_AQ;
 
                dns_dt_send(view, dtmsgtype, &client->peeraddr,
-                           TCP_CLIENT(client), NULL,
+                           &client->interface->addr, TCP_CLIENT(client), NULL,
                            &client->requesttime, NULL, buffer);
 #endif /* HAVE_DNSTAP */
 

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index be0a16b0e2f4cbbe6318fe7ff798a4cb7364aef3..cc7e6ff6f33ad6fffba5e789ffc52f2996772c6a 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -127,6 +127,17 @@
 
   <section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
     <itemizedlist>
+      <listitem>
+       <para>
+         <command>dnstap</command> now stores both the local and remote
+         addresses for all messages, instead of only the remote address.
+         The default output format for <command>dnstap-read</command> has
+         been updated to include these addresses, with the initiating
+         address first and the responding address second, separated by
+         "-%gt;" or "%lt;-" to indicate in which direction the message
+         was sent. [RT #43595]
+       </para>
+      </listitem>
       <listitem>
        <para>
          The built in mangaged keys for the global root zone have been

diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 0c841247e4fa5b740ef91c7bdc34c0319fc333af..3c9e4fd065ef41e642327d9fd6054102fe833f45 100644 (file)
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -674,8 +674,9 @@ setaddr(dns_dtmsg_t *dm, isc_sockaddr_t *sa, isc_boolean_t tcp,
 
 void
 dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
-           isc_sockaddr_t *sa, isc_boolean_t tcp, isc_region_t *zone,
-           isc_time_t *qtime, isc_time_t *rtime, isc_buffer_t *buf)
+           isc_sockaddr_t *qaddr, isc_sockaddr_t *raddr,
+           isc_boolean_t tcp, isc_region_t *zone, isc_time_t *qtime,
+           isc_time_t *rtime, isc_buffer_t *buf)
 {
        isc_time_t now, *t;
        dns_dtmsg_t dm;
@@ -758,20 +759,16 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
                break;
        }
 
-       switch (msgtype) {
-       case DNS_DTTYPE_RQ:
-       case DNS_DTTYPE_RR:
-       case DNS_DTTYPE_FQ:
-       case DNS_DTTYPE_FR:
-               setaddr(&dm, sa, tcp,
-                       &dm.m.response_address, &dm.m.has_response_address,
-                       &dm.m.response_port, &dm.m.has_response_port);
-               break;
-       default:
-               setaddr(&dm, sa, tcp,
+       if (qaddr != NULL) {
+               setaddr(&dm, qaddr, tcp,
                        &dm.m.query_address, &dm.m.has_query_address,
                        &dm.m.query_port, &dm.m.has_query_port);
        }
+       if (raddr != NULL) {
+               setaddr(&dm, raddr, tcp,
+                       &dm.m.response_address, &dm.m.has_response_address,
+                       &dm.m.response_port, &dm.m.has_response_port);
+       }
 
        if (pack_dt(&dm.d, &dm.buf, &dm.len) == ISC_R_SUCCESS)
                send_dt(view->dtenv, dm.buf, dm.len);
@@ -1052,11 +1049,17 @@ dns_dt_parse(isc_mem_t *mctx, isc_region_t *src, dns_dtdata_t **destp) {
                d->qaddr.base = m->query_address.data;
                d->qaddr.length = m->query_address.len;
        }
+       if (m->has_query_port) {
+               d->qport = m->query_port;
+       }
 
        if (m->has_response_address) {
                d->raddr.base = m->response_address.data;
                d->raddr.length = m->response_address.len;
        }
+       if (m->has_response_port) {
+               d->rport = m->response_port;
+       }
 
        /* Socket protocol */
        if (m->has_socket_protocol) {
@@ -1161,25 +1164,27 @@ dns_dt_datatotext(dns_dtdata_t *d, isc_buffer_t **dest) {
                return (DNS_R_BADDNSTAP);
        }
 
-       /* Peer address */
-       switch (d->type) {
-       case DNS_DTTYPE_RQ:
-       case DNS_DTTYPE_RR:
-       case DNS_DTTYPE_FQ:
-       case DNS_DTTYPE_FR:
-               if (d->raddr.length != 0)
-                       CHECK(putaddr(dest, &d->raddr));
-               else
-                       CHECK(putstr(dest, "?"));
-               break;
-       default:
-               if (d->qaddr.length != 0)
-                       CHECK(putaddr(dest, &d->qaddr));
-               else
-                       CHECK(putstr(dest, "?"));
-               break;
+       /* Query and response addresses */
+       if (d->qaddr.length != 0) {
+               CHECK(putaddr(dest, &d->qaddr));
+               snprintf(buf, sizeof(buf), ":%u", d->qport);
+               CHECK(putstr(dest, buf));
+       } else {
+               CHECK(putstr(dest, "?"));
        }
-
+       if ((d->type & DNS_DTTYPE_QUERY) != 0) {
+               CHECK(putstr(dest, " -> "));
+       } else {
+               CHECK(putstr(dest, " <- "));
+       }
+       if (d->raddr.length != 0) {
+               CHECK(putaddr(dest, &d->raddr));
+               snprintf(buf, sizeof(buf), ":%u", d->rport);
+               CHECK(putstr(dest, buf));
+       } else {
+               CHECK(putstr(dest, "?"));
+       }
+       
        CHECK(putstr(dest, " "));
 
        /* Protocol */

diff --git a/lib/dns/include/dns/dnstap.h b/lib/dns/include/dns/dnstap.h
index e8953783292fec9c41803dcb592d49571369fd84..883a2e592bfcdd7cff9c9ce638accf114b187372 100644 (file)
--- a/lib/dns/include/dns/dnstap.h
+++ b/lib/dns/include/dns/dnstap.h
@@ -100,6 +100,9 @@ struct dns_dtdata {
        isc_region_t qaddr;
        isc_region_t raddr;
 
+       isc_uint32_t qport;
+       isc_uint32_t rport;
+
        isc_region_t msgdata;
        dns_message_t *msg;
 
@@ -235,18 +238,20 @@ dns_dt_shutdown(void);
 
 void
 dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
-           isc_sockaddr_t *sa, isc_boolean_t tcp, isc_region_t *zone,
-           isc_time_t *qtime, isc_time_t *rtime, isc_buffer_t *buf);
+           isc_sockaddr_t *qaddr, isc_sockaddr_t *dstaddr,
+           isc_boolean_t tcp, isc_region_t *zone, isc_time_t *qtime,
+           isc_time_t *rtime, isc_buffer_t *buf);
 /*%<
  * Sends a dnstap message to the log, if 'msgtype' is one of the message
  * types represented in 'view->dttypes'.
  *
- * Parameters are: 'sa' (address of the peer in the DNS transaction being
- * logged); 'tcp' (boolean indicating whether the transaction was over
- * TCP); 'zone' (the authoritative zone or bailiwick, in uncompressed
- * wire format), 'qtime' and 'rtime' (query and response times; if
- * NULL, they are set to the current time); and 'buf' (the DNS message
- * being logged, in wire format).
+ * Parameters are: 'qaddr' (query address, i.e, the address of the
+ * query initiator); 'raddr' (response address, i.e., the address of
+ * the query responder); 'tcp' (boolean indicating whether the transaction
+ * was over TCP); 'zone' (the authoritative zone or bailiwick, in
+ * uncompressed wire format), 'qtime' and 'rtime' (query and response
+ * times; if NULL, they are set to the current time); and 'buf' (the
+ * DNS message being logged, in wire format).
  *
  * Requires:
  *

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 80cf5a7c76f7404ff350894bccf5075a3dae8317..3b49795108b4cb14551116593ea9f1343d2ad56c 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2115,6 +2115,7 @@ resquery_send(resquery_t *query) {
        unsigned ednsopt = 0;
        isc_uint16_t hint = 0, udpsize = 0;     /* No EDNS */
 #ifdef HAVE_DNSTAP
+       isc_sockaddr_t localaddr, *la = NULL;
        unsigned char zone[DNS_NAME_MAXWIRE];
        dns_dtmsgtype_t dtmsgtype;
        isc_region_t zr;
@@ -2581,7 +2582,11 @@ resquery_send(resquery_t *query) {
        else
                dtmsgtype = DNS_DTTYPE_RQ;
 
-       dns_dt_send(fctx->res->view, dtmsgtype, &query->addrinfo->sockaddr,
+       result = isc_socket_getsockname(sock, &localaddr);
+       if (result == ISC_R_SUCCESS)
+               la = &localaddr;
+
+       dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr,
                    ISC_TF((query->options & DNS_FETCHOPT_TCP) != 0),
                    &zr, &query->start, NULL, &query->buffer);
 #endif /* HAVE_DNSTAP */
@@ -7772,6 +7777,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
        dns_resolver_t *res;
        isc_boolean_t bucket_empty;
 #ifdef HAVE_DNSTAP
+       isc_socket_t *sock = NULL;
+       isc_sockaddr_t localaddr, *la = NULL;
        unsigned char zone[DNS_NAME_MAXWIRE];
        dns_dtmsgtype_t dtmsgtype;
        dns_compress_t cctx;
@@ -7983,12 +7990,26 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
                dns_compress_invalidate(&cctx);
        }
 
-       if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0)
+       if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
                dtmsgtype = DNS_DTTYPE_FR;
-       else
+       } else {
                dtmsgtype = DNS_DTTYPE_RR;
+       }
+
+       if (query->exclusivesocket) {
+               sock = dns_dispatch_getentrysocket(query->dispentry);
+       } else {
+               sock = dns_dispatch_getsocket(query->dispatch);
+       }
+
+       if (sock != NULL) {
+               result = isc_socket_getsockname(sock, &localaddr);
+               if (result == ISC_R_SUCCESS) {
+                       la = &localaddr;
+               }
+       }
 
-       dns_dt_send(res->view, dtmsgtype, &query->addrinfo->sockaddr,
+       dns_dt_send(res->view, dtmsgtype, la, &query->addrinfo->sockaddr,
                    ISC_TF((query->options & DNS_FETCHOPT_TCP) != 0),
                    &zr, &query->start, NULL, &devent->buffer);
 #endif /* HAVE_DNSTAP */
@@ -8781,7 +8802,6 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
        }
 }
 
-
 /***
  *** Resolver Methods
  ***/

diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
index 98a075b2bbe5baeca048df1c19d466d5c045243c..9c895fb123eb72352d6564f065ecb6d7cfca7333 100644 (file)
--- a/lib/dns/tests/dnstap_test.c
+++ b/lib/dns/tests/dnstap_test.c
@@ -131,7 +131,8 @@ ATF_TC_BODY(send, tc) {
        dns_view_t *view = NULL;
        dns_compress_t cctx;
        isc_region_t zr;
-       isc_sockaddr_t addr;
+       isc_sockaddr_t qaddr;
+       isc_sockaddr_t raddr;
        struct in_addr in;
        isc_stdtime_t now;
        isc_time_t p, f;
@@ -176,7 +177,9 @@ ATF_TC_BODY(send, tc) {
        isc_buffer_usedregion(&zb, &zr);
 
        in.s_addr = inet_addr("10.53.0.1");
-       isc_sockaddr_fromin(&addr, &in, 2112);
+       isc_sockaddr_fromin(&qaddr, &in, 2112);
+       in.s_addr = inet_addr("10.53.0.2");
+       isc_sockaddr_fromin(&raddr, &in, 2112);
 
        isc_stdtime_get(&now);
        isc_time_set(&p, now - 3600, 0); /* past */
@@ -208,6 +211,7 @@ ATF_TC_BODY(send, tc) {
 
        for (dt = DNS_DTTYPE_SQ; dt <= DNS_DTTYPE_TR; dt <<= 1) {
                isc_buffer_t *m;
+               isc_sockaddr_t *q = &qaddr, *r = &raddr;
 
                switch (dt) {
                case DNS_DTTYPE_AQ:
@@ -223,14 +227,14 @@ ATF_TC_BODY(send, tc) {
                        break;
                }
 
-               dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, &p, &f, m);
-               dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, NULL, &f, m);
-               dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, &p, NULL, m);
-               dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, NULL, NULL, m);
-               dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, &p, &f, m);
-               dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, NULL, &f, m);
-               dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, &p, NULL, m);
-               dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, NULL, NULL, m);
+               dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, &p, &f, m);
+               dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, NULL, &f, m);
+               dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, &p, NULL, m);
+               dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, NULL, NULL, m);
+               dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, &p, &f, m);
+               dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, NULL, &f, m);
+               dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, &p, NULL, m);
+               dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, NULL, NULL, m);
        }
 
        dns_dt_detach(&view->dtenv);
@@ -300,7 +304,7 @@ ATF_TC_BODY(totext, tc) {
        ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
        /* make sure text conversion gets the right local time */
-       setenv("TZ", "MST7", 1);
+       setenv("TZ", "PST8", 1);
 
        while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) {
                dns_dtdata_t *dtdata = NULL;

diff --git a/lib/dns/tests/testdata/dnstap/dnstap.saved b/lib/dns/tests/testdata/dnstap/dnstap.saved
index 9ccb166275f157703786b53f8ec5bb31186e9c41..c657f41bcd5095084ef94b5e40cfc62dbe409f42 100644 (file)
Binary files a/lib/dns/tests/testdata/dnstap/dnstap.saved and b/lib/dns/tests/testdata/dnstap/dnstap.saved differ

diff --git a/lib/dns/tests/testdata/dnstap/dnstap.text b/lib/dns/tests/testdata/dnstap/dnstap.text
index e052ab4fa021616d780730666cffec0e1e9fab9f..71977e446f65db8ef4701b71186afd29f77bb66f 100644 (file)
--- a/lib/dns/tests/testdata/dnstap/dnstap.text
+++ b/lib/dns/tests/testdata/dnstap/dnstap.text
@@ -1,96 +1,96 @@
-18-Sep-2015 12:06:38.000 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 SR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 SR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 SR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 SR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 SR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 CR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 CR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 CR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 CR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 CR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 AR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 AR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 AR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 AR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 AR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 RR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 RR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 RR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 RR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 RR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 FR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 FR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 FR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 FR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 FR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 12:06:38.000 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 TR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 TR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TR 10.53.0.1 UDP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 TR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 14:06:38.000 TR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TR 10.53.0.1 TCP 287b www.isc.org/IN/A
-18-Sep-2015 13:06:38.112 TR 10.53.0.1 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A
+03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A