Viewing a Name Servers Cache

Viewing a Name Server s Cache

5.4.1 Problem

You want to view a name server's cached data.

5.4.2 Solution

Use rndc dumpdb (BIND 9) or ndc dumpdb (BIND 8) to dump the cache to disk, then look through the dump file.

5.4.3 Discussion

BIND 9 name servers only dump the contents of the cache to disk by default, but BIND 8 name servers dump both the contents of cache and authoritative zone data to disk, so you'll have to find the cached records in the file.

To determine which records in a BIND 8 database dump were cached, look at the TTLs and the contents of the comment field. Authoritative zone data will have the nice, round TTLs you configured, while cached records will have had their TTLs decremented by the number of seconds they've been in the cache. Cached records will also have "Cr=" as a comment at the end of the record, giving the credibility level of the record (an indication of the quality of the cached record). For example, these records were cached from an authoritative response from the name server at 128.9.0.107:

. 518380 IN NS I.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS E.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS D.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS A.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS H.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS C.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS G.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS F.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS B.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS J.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS K.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS L.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107] 518380 IN NS M.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]

Remember that dumping the cache to disk has no effect on the contents of the cache. If you want to flush (clear) the cache, see Recipe Section 5.5.

5.4.4 See Also

Section 5.5 and "Controlling the Name Server" in Chapter 7 of DNS and BIND.