I have packetbeat installed on my DNS server. The intent was to capture any DNS traffic from clients on my network. This is working well, I'm seeing client lookups being recorded. However, when my DNS server has to go out to public DNS to do a recursive lookup, the original client performing the request is lost and it appears as if the DNS query comes from the DNS server itself. Is there a way to capture the IP of the original request?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.