<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p> I would like to kindly ask for an advice here.</p>
<p> I spoof certain A records to a single IP address on my DNS
backends. Based on this IP I would like to log them in order to
identify the clients sending such requests. I am not sure what is
the best way to do it. I know that I have to use addResponseAction
together with DnstapLogResponseAction or with LuaResponseAction.
Nevertheless I am not sure how to code it...</p>
<p>Will this approach work?<br>
</p>
<p><font size="4" face="monospace">function checkResponseIP(dr)<br>
if dr.qtype == DNSQType.A and "IP in the response is w.x.y.z"
then<br>
-->> DnstapLogResponseAction("dnsdist", log-receiver)
<<<---<br>
return DNSResponseAction.None<br>
end <br>
return DNSResponseAction.None<br>
end</font><br>
<br>
<font size="4" face="monospace">addResponseAction(AllRule(),
LuaResponseAction((checkResponseIP)))</font><br>
</p>
<p>Or is there a way how to use a function matching the response
instead of AllRule() and then simply use:</p>
<p><font size="4" face="monospace">addResponseAction(MyIPResponseMatchingRule(),
</font><font size="4" face="monospace">DnstapLogResponseAction("dnsdist",
log-receiver)</font><font size="4" face="monospace">)</font></p>
<p>or</p>
<p><font size="4" face="monospace">addCacheHitResponseAction</font><font
size="4" face="monospace">(MyIPResponseMatchingRule(), </font><font
size="4" face="monospace">DnstapLogResponseAction("dnsdist",
log-receiver)</font><font size="4" face="monospace">)</font></p>
<p><font size="4">respectively?</font><font size="4"
face="monospace"><br>
</font></p>
<p><font size="4">Thanks <br>
</font></p>
<p><font size="4">Regards</font></p>
<p><font size="4">Ales</font><font size="4" face="monospace"><br>
</font></p>
</body>
</html>