# Origin of Recursive Lookup Not Captured

**URL:** <https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [November 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479 "2021-11-17T16:16:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [November 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479/1 "2021-11-17T16:16:37Z")

</div>

I have packetbeat installed on my DNS server. The intent was to capture any DNS traffic from clients on my network. This is working well, I'm seeing client lookups being recorded. However, when my DNS server has to go out to public DNS to do a recursive lookup, the original client performing the request is lost and it appears as if the DNS query comes from the DNS server itself. Is there a way to capture the IP of the original request?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2021, 6:16pm UTC](https://discuss.elastic.co/t/origin-of-recursive-lookup-not-captured/289479/2 "2021-12-15T18:16:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.