From 07b7a3eadeda94eddd50977c9582dae2f955b638 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Fri, 3 Feb 2017 17:11:06 -0800 Subject: [PATCH] [v9_11] store local and remote addresses in dnstap 4569. [func] Store both local and remote addresses in dnstap logging, and modify dnstap-read output format to print them. [RT #43595] (cherry picked from commit 650b5e7592be43d6994ba425bc1fa654d538cd7e) --- CHANGES | 4 + bin/named/client.c | 13 +- doc/arm/notes.xml | 11 ++ lib/dns/dnstap.c | 67 +++---- lib/dns/include/dns/dnstap.h | 21 ++- lib/dns/resolver.c | 30 +++- lib/dns/tests/dnstap_test.c | 26 +-- lib/dns/tests/testdata/dnstap/dnstap.saved | Bin 29534 -> 30398 bytes lib/dns/tests/testdata/dnstap/dnstap.text | 192 ++++++++++----------- 9 files changed, 207 insertions(+), 157 deletions(-) diff --git a/CHANGES b/CHANGES index 27d36e92c0..9e37690005 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +4569. [func] Store both local and remote addresses in dnstap + logging, and modify dnstap-read output format to + print them. [RT #43595] + 4568. [contrib] Added a --with-bind option to the dnsperf configure script to specify BIND prefix path. diff --git a/bin/named/client.c b/bin/named/client.c index 89721a7e7d..404a25a6d1 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -1188,12 +1188,12 @@ client_send(ns_client_t *client) { isc_buffer_usedregion(&buffer, &r); isc_buffer_putuint16(&tcpbuffer, (isc_uint16_t) r.length); isc_buffer_add(&tcpbuffer, r.length); - #ifdef HAVE_DNSTAP if (client->view != NULL) { dns_dt_send(client->view, dtmsgtype, - &client->peeraddr, ISC_TRUE, &zr, - &client->requesttime, NULL, &buffer); + &client->peeraddr, &client->interface->addr, + ISC_TRUE, &zr, &client->requesttime, NULL, + &buffer); } #endif /* HAVE_DNSTAP */ @@ -1217,11 +1217,12 @@ client_send(ns_client_t *client) { } else { respsize = isc_buffer_usedlength(&buffer); result = client_sendpkg(client, &buffer); - #ifdef HAVE_DNSTAP if (client->view != NULL) { dns_dt_send(client->view, dtmsgtype, - &client->peeraddr, ISC_FALSE, &zr, + &client->peeraddr, + &client->interface->addr, + ISC_FALSE, &zr, &client->requesttime, NULL, &buffer); } #endif /* HAVE_DNSTAP */ @@ -2784,7 +2785,7 @@ client_request(isc_task_t *task, isc_event_t *event) { dtmsgtype = DNS_DTTYPE_AQ; dns_dt_send(view, dtmsgtype, &client->peeraddr, - TCP_CLIENT(client), NULL, + &client->interface->addr, TCP_CLIENT(client), NULL, &client->requesttime, NULL, buffer); #endif /* HAVE_DNSTAP */ diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index be0a16b0e2..cc7e6ff6f3 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -127,6 +127,17 @@
Feature Changes + + + dnstap now stores both the local and remote + addresses for all messages, instead of only the remote address. + The default output format for dnstap-read has + been updated to include these addresses, with the initiating + address first and the responding address second, separated by + "-%gt;" or "%lt;-" to indicate in which direction the message + was sent. [RT #43595] + + The built in mangaged keys for the global root zone have been diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c index 0c841247e4..3c9e4fd065 100644 --- a/lib/dns/dnstap.c +++ b/lib/dns/dnstap.c @@ -674,8 +674,9 @@ setaddr(dns_dtmsg_t *dm, isc_sockaddr_t *sa, isc_boolean_t tcp, void dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, - isc_sockaddr_t *sa, isc_boolean_t tcp, isc_region_t *zone, - isc_time_t *qtime, isc_time_t *rtime, isc_buffer_t *buf) + isc_sockaddr_t *qaddr, isc_sockaddr_t *raddr, + isc_boolean_t tcp, isc_region_t *zone, isc_time_t *qtime, + isc_time_t *rtime, isc_buffer_t *buf) { isc_time_t now, *t; dns_dtmsg_t dm; @@ -758,20 +759,16 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, break; } - switch (msgtype) { - case DNS_DTTYPE_RQ: - case DNS_DTTYPE_RR: - case DNS_DTTYPE_FQ: - case DNS_DTTYPE_FR: - setaddr(&dm, sa, tcp, - &dm.m.response_address, &dm.m.has_response_address, - &dm.m.response_port, &dm.m.has_response_port); - break; - default: - setaddr(&dm, sa, tcp, + if (qaddr != NULL) { + setaddr(&dm, qaddr, tcp, &dm.m.query_address, &dm.m.has_query_address, &dm.m.query_port, &dm.m.has_query_port); } + if (raddr != NULL) { + setaddr(&dm, raddr, tcp, + &dm.m.response_address, &dm.m.has_response_address, + &dm.m.response_port, &dm.m.has_response_port); + } if (pack_dt(&dm.d, &dm.buf, &dm.len) == ISC_R_SUCCESS) send_dt(view->dtenv, dm.buf, dm.len); @@ -1052,11 +1049,17 @@ dns_dt_parse(isc_mem_t *mctx, isc_region_t *src, dns_dtdata_t **destp) { d->qaddr.base = m->query_address.data; d->qaddr.length = m->query_address.len; } + if (m->has_query_port) { + d->qport = m->query_port; + } if (m->has_response_address) { d->raddr.base = m->response_address.data; d->raddr.length = m->response_address.len; } + if (m->has_response_port) { + d->rport = m->response_port; + } /* Socket protocol */ if (m->has_socket_protocol) { @@ -1161,25 +1164,27 @@ dns_dt_datatotext(dns_dtdata_t *d, isc_buffer_t **dest) { return (DNS_R_BADDNSTAP); } - /* Peer address */ - switch (d->type) { - case DNS_DTTYPE_RQ: - case DNS_DTTYPE_RR: - case DNS_DTTYPE_FQ: - case DNS_DTTYPE_FR: - if (d->raddr.length != 0) - CHECK(putaddr(dest, &d->raddr)); - else - CHECK(putstr(dest, "?")); - break; - default: - if (d->qaddr.length != 0) - CHECK(putaddr(dest, &d->qaddr)); - else - CHECK(putstr(dest, "?")); - break; + /* Query and response addresses */ + if (d->qaddr.length != 0) { + CHECK(putaddr(dest, &d->qaddr)); + snprintf(buf, sizeof(buf), ":%u", d->qport); + CHECK(putstr(dest, buf)); + } else { + CHECK(putstr(dest, "?")); } - + if ((d->type & DNS_DTTYPE_QUERY) != 0) { + CHECK(putstr(dest, " -> ")); + } else { + CHECK(putstr(dest, " <- ")); + } + if (d->raddr.length != 0) { + CHECK(putaddr(dest, &d->raddr)); + snprintf(buf, sizeof(buf), ":%u", d->rport); + CHECK(putstr(dest, buf)); + } else { + CHECK(putstr(dest, "?")); + } + CHECK(putstr(dest, " ")); /* Protocol */ diff --git a/lib/dns/include/dns/dnstap.h b/lib/dns/include/dns/dnstap.h index e895378329..883a2e592b 100644 --- a/lib/dns/include/dns/dnstap.h +++ b/lib/dns/include/dns/dnstap.h @@ -100,6 +100,9 @@ struct dns_dtdata { isc_region_t qaddr; isc_region_t raddr; + isc_uint32_t qport; + isc_uint32_t rport; + isc_region_t msgdata; dns_message_t *msg; @@ -235,18 +238,20 @@ dns_dt_shutdown(void); void dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, - isc_sockaddr_t *sa, isc_boolean_t tcp, isc_region_t *zone, - isc_time_t *qtime, isc_time_t *rtime, isc_buffer_t *buf); + isc_sockaddr_t *qaddr, isc_sockaddr_t *dstaddr, + isc_boolean_t tcp, isc_region_t *zone, isc_time_t *qtime, + isc_time_t *rtime, isc_buffer_t *buf); /*%< * Sends a dnstap message to the log, if 'msgtype' is one of the message * types represented in 'view->dttypes'. * - * Parameters are: 'sa' (address of the peer in the DNS transaction being - * logged); 'tcp' (boolean indicating whether the transaction was over - * TCP); 'zone' (the authoritative zone or bailiwick, in uncompressed - * wire format), 'qtime' and 'rtime' (query and response times; if - * NULL, they are set to the current time); and 'buf' (the DNS message - * being logged, in wire format). + * Parameters are: 'qaddr' (query address, i.e, the address of the + * query initiator); 'raddr' (response address, i.e., the address of + * the query responder); 'tcp' (boolean indicating whether the transaction + * was over TCP); 'zone' (the authoritative zone or bailiwick, in + * uncompressed wire format), 'qtime' and 'rtime' (query and response + * times; if NULL, they are set to the current time); and 'buf' (the + * DNS message being logged, in wire format). * * Requires: * diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 80cf5a7c76..3b49795108 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -2115,6 +2115,7 @@ resquery_send(resquery_t *query) { unsigned ednsopt = 0; isc_uint16_t hint = 0, udpsize = 0; /* No EDNS */ #ifdef HAVE_DNSTAP + isc_sockaddr_t localaddr, *la = NULL; unsigned char zone[DNS_NAME_MAXWIRE]; dns_dtmsgtype_t dtmsgtype; isc_region_t zr; @@ -2581,7 +2582,11 @@ resquery_send(resquery_t *query) { else dtmsgtype = DNS_DTTYPE_RQ; - dns_dt_send(fctx->res->view, dtmsgtype, &query->addrinfo->sockaddr, + result = isc_socket_getsockname(sock, &localaddr); + if (result == ISC_R_SUCCESS) + la = &localaddr; + + dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr, ISC_TF((query->options & DNS_FETCHOPT_TCP) != 0), &zr, &query->start, NULL, &query->buffer); #endif /* HAVE_DNSTAP */ @@ -7772,6 +7777,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) { dns_resolver_t *res; isc_boolean_t bucket_empty; #ifdef HAVE_DNSTAP + isc_socket_t *sock = NULL; + isc_sockaddr_t localaddr, *la = NULL; unsigned char zone[DNS_NAME_MAXWIRE]; dns_dtmsgtype_t dtmsgtype; dns_compress_t cctx; @@ -7983,12 +7990,26 @@ resquery_response(isc_task_t *task, isc_event_t *event) { dns_compress_invalidate(&cctx); } - if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) + if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) { dtmsgtype = DNS_DTTYPE_FR; - else + } else { dtmsgtype = DNS_DTTYPE_RR; + } - dns_dt_send(res->view, dtmsgtype, &query->addrinfo->sockaddr, + if (query->exclusivesocket) { + sock = dns_dispatch_getentrysocket(query->dispentry); + } else { + sock = dns_dispatch_getsocket(query->dispatch); + } + + if (sock != NULL) { + result = isc_socket_getsockname(sock, &localaddr); + if (result == ISC_R_SUCCESS) { + la = &localaddr; + } + } + + dns_dt_send(res->view, dtmsgtype, la, &query->addrinfo->sockaddr, ISC_TF((query->options & DNS_FETCHOPT_TCP) != 0), &zr, &query->start, NULL, &devent->buffer); #endif /* HAVE_DNSTAP */ @@ -8781,7 +8802,6 @@ resquery_response(isc_task_t *task, isc_event_t *event) { } } - /*** *** Resolver Methods ***/ diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c index 98a075b2bb..9c895fb123 100644 --- a/lib/dns/tests/dnstap_test.c +++ b/lib/dns/tests/dnstap_test.c @@ -131,7 +131,8 @@ ATF_TC_BODY(send, tc) { dns_view_t *view = NULL; dns_compress_t cctx; isc_region_t zr; - isc_sockaddr_t addr; + isc_sockaddr_t qaddr; + isc_sockaddr_t raddr; struct in_addr in; isc_stdtime_t now; isc_time_t p, f; @@ -176,7 +177,9 @@ ATF_TC_BODY(send, tc) { isc_buffer_usedregion(&zb, &zr); in.s_addr = inet_addr("10.53.0.1"); - isc_sockaddr_fromin(&addr, &in, 2112); + isc_sockaddr_fromin(&qaddr, &in, 2112); + in.s_addr = inet_addr("10.53.0.2"); + isc_sockaddr_fromin(&raddr, &in, 2112); isc_stdtime_get(&now); isc_time_set(&p, now - 3600, 0); /* past */ @@ -208,6 +211,7 @@ ATF_TC_BODY(send, tc) { for (dt = DNS_DTTYPE_SQ; dt <= DNS_DTTYPE_TR; dt <<= 1) { isc_buffer_t *m; + isc_sockaddr_t *q = &qaddr, *r = &raddr; switch (dt) { case DNS_DTTYPE_AQ: @@ -223,14 +227,14 @@ ATF_TC_BODY(send, tc) { break; } - dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, &p, &f, m); - dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, NULL, &f, m); - dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, &p, NULL, m); - dns_dt_send(view, dt, &addr, ISC_FALSE, &zr, NULL, NULL, m); - dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, &p, &f, m); - dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, NULL, &f, m); - dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, &p, NULL, m); - dns_dt_send(view, dt, &addr, ISC_TRUE, &zr, NULL, NULL, m); + dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, &p, &f, m); + dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, NULL, &f, m); + dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, &p, NULL, m); + dns_dt_send(view, dt, q, r, ISC_FALSE, &zr, NULL, NULL, m); + dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, &p, &f, m); + dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, NULL, &f, m); + dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, &p, NULL, m); + dns_dt_send(view, dt, q, r, ISC_TRUE, &zr, NULL, NULL, m); } dns_dt_detach(&view->dtenv); @@ -300,7 +304,7 @@ ATF_TC_BODY(totext, tc) { ATF_REQUIRE_EQ(result, ISC_R_SUCCESS); /* make sure text conversion gets the right local time */ - setenv("TZ", "MST7", 1); + setenv("TZ", "PST8", 1); while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) { dns_dtdata_t *dtdata = NULL; diff --git a/lib/dns/tests/testdata/dnstap/dnstap.saved b/lib/dns/tests/testdata/dnstap/dnstap.saved index 9ccb166275f157703786b53f8ec5bb31186e9c41..c657f41bcd5095084ef94b5e40cfc62dbe409f42 100644 GIT binary patch literal 30398 zcmeHQO=whC7`^Y!%j6j&9jHhIk-?@k6>JlVprVk4LJ);iT%^UqOrp~SoXqr%l874x zO@eR#o3FjY?z)22XKizO zb~0GemV)8C(697?g%3}<@oW$c;SSzs#blrWwAZ>`L9)SfeZ_3at&h2!?9iF(t% z+JAva>9Fp%nCkZuU)f&f{J3%WfM4Kygj04)k!{G8tBrhPy0N1^?iWJ8=yn>F@v^@! z^rOx8bVKZb_2tUc$*FQ<2j5Q4)O4lBLXGl#e;nt3wws3JLpV!$Yb$@gWo5`h(duHX zB=${k4f>bDZP`}-ytVBQubZ+#|46efUrLTY54Clcc}ubV#kD!KK})y(~p(9vA&7!Fnph+4DG!hfCcKAQBUS|p?dIonHb~NfGeXOydJ2xO4Nhu8BmV`?jOSlxK!ED_j)qb zBd@n`2wqQ(=8D%7V8QF@c)g%h+@&t-nb)5?bxL#|J8D{iT&buFMtmH*_`e37(7qe*7yP7M)B9lmwZoIDFO zP0^IZ4d`ZU-2|HA4NMmMUC`E@E<=-avpA2Pp2kimG~LTUQxDA`+py$zv*ldQ)qYkK zrwRC_cP^(>r{v+EUlYzawNAs?MrxhXO#Po?&s4JAlVd9DlxBMS##)(a=@-+PTHkn& zZP%6)_1g{ICuYml`pFZyiCUE*+?$4bfSb>(-fqNP3SWJ{A$;kDuNdI6y8zb|TuID< z<|a%E-e@ks4UWa8TB$Mtmo)e1MaV)1vOwT2JOa3S;Ifi;%+1MdZcFZ<`#Fg=ofh?o z$T29D82eKg^sL4RXKPuFLF*X!E3I`%R66z7LpBDjqwx2Kv5u$zBwU9*=bi6z9rXsm zaZ$x_(KcZ~(rlPCM>7#e`1H?Ffr-gdiD)KbciwCX$sIeZ?&R zm>7$R0y~`d(>d?gWTMPeLlY65-^FL3MYbKyMEFE7@%>;TG%-FC$tOPfXdcn|buB;o zRtImYII`$WKGFYp9zIctW_#{TOcdC`C+hgbpcdY(E+;0gg?Ac*$X@z{lRdLBLeieu z7_^R&&(d0lOc>H$hinX5N8gtp#yZ$n3D-gH)m3j0Wb}p^ec=3YdnB!UNj3ARPE14| z72myriTc>7nHUOE&_qK`B=@@f9o(x)y}gqrl9hQ{<`w`Jw#5B%e5X20l@Z zX1gX569sngi8?+p_`LCYbvaSHPAx)yWT(XL;(3!osIt?Lc&9zn=L@lCD%;$NXDaKI zFnw}mt<3cHb<>&B&DeX@L`7z;$gFX&-1K01@GmGjQ4a}>zHJ2cQl(xfltA@Vsz=6f zw$W!L_MgU r0rkl1-Mf!~YwGo60hhd9eF*;tsasNu@@JH@{PgK=O literal 29534 zcmeHPPiP!v6#wQ=He=Jm9z+wUWvvyW(2|2fED8}S>_rHzAb2sGHfaLgKb@&$LA-fT zp&mpf2hkopn3{M45)SXG^sDI#P z;mi!{b3a}G=liiY<$L1v^j6?Bv;}F$TU%T6R-?0CH$1P*O2aSI)oJqRt53DOS()-Sgc{^bV;atZd0d->RhL?&O1|BqqA zgTyoOs_?&fa_)^`T~b<7?QlaJ@>=bv7ImWIy~Sajy)o`b%ZshyYwV>dw-YJmPPCR+ zFRZqrvQtYUZIbaAL0L8bB@U8hqphn-f+f*SWtY|$IS2(ey%to zpC`|~xO1wQ8J>>MmH&z-pR;rQd-6=RTGcVd7S_U_|H>8ARxgJDOMWTxOUMOFMWIZ_ zX%H!-0mK3j!8nWMnaenqtiZS;#_6orUb#D{A;ziPRw~AkbeR25rf4v(0K^4ioB|7s zvtt|+tB7&Xal0aVlUbE94mu8u+grvV##u0qvTFaCO=MNwqcGQTEXI+JYd*gT9ajkA zwvJO^LC2ZsINhTi%WcQm_j^;eh`hI7lH{#yi-q3Gw#ct5bEW-a3$(Id%oh38Ywl0K zrr)yl%XvNg(G6+|f}x>g*-!$As@*M*vQ2YUKV*Wams@)!Lb{-fC`AJ0At27a4-joZ zi~~PnV(FL&5KCQ1OvXe8BE`hvr&!JvmNS94@fkog15wu@PC_Oo=1wjj6Ag9MT^?q0 zCn;N`tHpOpzgD%y^?p@b&4cr95-Z?bB z)Ni$W7nZ!U-L^mqwoSpnbf+OD$AGGj_UMdkfGOpc8@G^K%yNs#+9ym`?f_F;Oyi`1 zcv`VT@nG!()6vJ%d`xNW-|?>En!!#!d+0=E98Zfd9ZmpKvv?}r4$lOhlBX}~x%=6Y zbN8tjtRzL2X_EK-r>|OEmN7KVt0U991q@A-*E7$J%4>J`ux6&o>)R(DN3XA(tmw7- zL3qy({9IyVGO=JXF|{;Mq*@lKnFPexnE4P72v|+kXA+PlNkl-)2uN~$eF@UiOj>3V zkVMJ+MVa0~z)}QM*kQ)ZWX3EeAXCMNfJni6alfppfHMgQ4G020QUW3ZmM0)-!2ah* z!L}NZrC`#4&99&Vi$P3R!9+lX9WE)6P0}*RB{qs{%i>zga%^v7v=>lZ+oTAH+NQj; z1Od&l%OxO7H;90i5s;+i{NIq4#j-q?fFw#9cV&790ZS23VTanrq_&AQAXCMNfaYl= zRn%d|q123n(twPB(10M|-uAas1VjWZPe9Uu&8cfh!A2v=nJJhw;N-K{paBa(Os8NX zpu!Fs&_o03`&TDa8*oJXfTwH`mv5bsTsH3C>gKrGgFR)71?I}O$glNxOZyeyLXfzB z)pT+^@jo(KV;poG x7`L~KLyWUv9O<|lzagvI>NpnTNXM=J4joqv;`YAj3M}Y26CI~_BJ|~>cOU)%cJcrK diff --git a/lib/dns/tests/testdata/dnstap/dnstap.text b/lib/dns/tests/testdata/dnstap/dnstap.text index e052ab4fa0..71977e446f 100644 --- a/lib/dns/tests/testdata/dnstap/dnstap.text +++ b/lib/dns/tests/testdata/dnstap/dnstap.text @@ -1,96 +1,96 @@ -18-Sep-2015 12:06:38.000 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 SR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 SR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 SR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 SR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 SR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 CR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 CR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 CR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 CR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 CR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 AR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 AR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 AR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 AR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 AR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 RR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 RR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 RR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 RR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 RR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 FR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 FR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 FR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 FR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 FR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TQ 10.53.0.1 UDP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 12:06:38.000 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TQ 10.53.0.1 TCP 40b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 TR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 TR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TR 10.53.0.1 UDP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 TR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 14:06:38.000 TR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TR 10.53.0.1 TCP 287b www.isc.org/IN/A -18-Sep-2015 13:06:38.112 TR 10.53.0.1 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 SR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 CR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 AR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 RR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 FR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 UDP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 15:47:16.000 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TQ 10.53.0.1:2112 -> 10.53.0.2:2112 TCP 40b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 UDP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 17:47:16.000 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A +03-Feb-2017 16:47:16.830 TR 10.53.0.1:2112 <- 10.53.0.2:2112 TCP 287b www.isc.org/IN/A