DNS Transaction logging

Well... How good are you at writing iRules (TCP) to pull apart the queries and responses?

 

 

if you take a look at the iRule I uploaded last year for measuring LDAP response times, you could alter that for DNS. Remember that DNS is (Usually) going to be UDP, not TCP. But at least the datagrams are reasonably easy to decode (Admittedly it's been a few years since I had to, but there are good RFC's out there that describe in glorious detail what they look like).

 

 

Basically it degenerates into decoding and counting... Counting is done via tables and sub-tables... (Oh how I long for functions in iRules :)

 

 

H