[Samba] How to trace a DNS query back to workstation or application

James lingpanda101 at gmail.com
Thu Feb 26 09:44:02 MST 2015


    Looking through my samba logs I'm seeing entries such as this

[2015/02/26 11:39:33.527590,  2, pid=1184, effective(0, 0), real(0, 0)]
  Not authoritative for 'searchclient.live.net', forwarding

This will repeat several times a second for hours. How can I trace this
back to a workstation or application short of using Wireshark? I'm
currently using Samba 4.1.17 with the internal DNS. Thanks.


More information about the samba mailing list