Hi Veronique, What is being logged is individual queries (or rather, query responses in actual fact, as those queries are responded to).
It doesn't make any difference to the logging how they arrived - each query is logged independently, whether it was pipelined over TCP, arrived non-pipelined, or came in over UDP. You can't determine whether a client is using TCP pipelining from looking at the querylog channel - that's because what is being logged is individual queries being handled, not client connections and how the queries are transported. Hoping this helps. Cathy On 20/12/2019 15:44, Veronique Lefebure wrote: > Many thanks for your reply. It answers the second part of my question. > But what about the first part of the question: " If a client is using > TCP-pipelining, and if querylog channel is enabled, what will appear in the > query log file for that client ? Shall we see one line per DNS query, i.e. N > lines if the client has sent N queries in the pipeline, or shall we see only > one line ?" > > You say "Just seeing multiple queries from the same client TCP connection > doesn't mean that it is pipelining them." > But are we sure that one would see multiple queries in the querylogs in case > of pipelining ? > > Thanks, > Veronique > > -----Original Message----- > From: Cathy Almond <cat...@isc.org> > Sent: 09 December 2019 10:05 > To: Veronique Lefebure <veronique.lefeb...@cern.ch> > Subject: Re: FW: Question about CVE-2019-6477: TCP-pipelined queries can > bypass tcp-clients limit > > Hi Veronique, > > I replied the same day: > > https://lists.isc.org/pipermail/bind-users/2019-November/102372.html > > But oddly, I don't see your posting on the list at all, just my reply. > > It looks like it never made it to the list - the reason being that you can't > post to the list unless you're a subscriber (which, after > checking, it turns out that you're not). You should have received an > auto-reply saying that your posting was held for moderation because you > weren't signed-up to the list. > > I'm guessing that you BCCd me when you posted, and I just replied to the > list, thinking that your posting had come from the list and not directly. > > So.. if you didn't subscribe, you wouldn't have seen the reply... > > Cathy > > > _______________________________________________ > Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe > from this list > > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users > _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
