Hey guys. I was checking out the CSUBNET option in EDNS0 options and 
thought "Aha! Just what I need to figure out what client IP hit one of 
my DNS filters". But I don't see any way to get named to log not just 
the client IP and the query, but also what CSUBNET shows up in the EDNS 
options. Is this possible?


    Here's why I'm thinking this would be good. At my $DAYJOB I've setup 
filtering DNS proxies for the company to use but there's a bunch of 
departmental DNS servers too, whose logs I don't have access to (and 
they probably don't log queries anyway). So when I see a bunch of hits 
on the DNS filters (ie, a bunch of pseudo-random hostnames used in some 
BOT C&C stuff, and I try to determine which client system is making the 
queries, sometimes the IP I see in the logs is some other departmental 
DNS server instead of the originating IP. I was thinking perhaps I could 
get that info from the CSUBNET part of the EDNS0 options fields. But I'm 
guessing they don't get logged anywhere?

    Anyway, if it's not already a feature, it might be a useful feature 
to have.


Brent