Is there a way to track where DNS request are coming from

Hi,

I would like to know if there is a way to track where (what client ) is requesting which websites from our internal DNS servers.

Environment: Parent domain with 4 AD/DNS all forward request to one DC/DNS (AD integrated), child domain (where security principals are) 12 AD/DNS servers all forward to the that one Parent AD/DNS server and our security team would like to trace back some of the request going out of it.  ie find the user making the request. They are seeing "funny request " from that server and want to make sure it is not compromised.

I checked the logs and all I see is what is leaving and where it is going not what desktop/computer/device is making the request.  I would like to know if there is a way to track the request back to at least an subnet to narrow it down.

AilBoogie