OS: Ubuntu 10.04.4 LTS Tshark: 1.2.7 I'm trying to sniff all DNS traffic and output queries and answers to a text file for parsing. All queries for 'A' records return the needed information: response name, address and ttl. Queries for PTR records do not display all fields (the fields dns.resp.addr, dns.resp.name, and dns.resp.primaryname return no values). What can be done to output the info to a text file? Specifying fields with Tshark is great but missing the domain name returned from the PTR query is odd. An oversight/bug? Any help is appreciated. ---OUTPUT--- sudo tshark -n -s0 -i eth4 port 53 sudo tshark -n -s0 -i eth4 port 53 -T fields -E separator=\, -e frame.time -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.name -e dns.resp.addr -e dns.resp.ttl ---ADDITION--- asked 21 Nov '12, 09:21 twhisnant edited 21 Nov '12, 09:34 |
One Answer:
There is no filter for the PTR response in the current release. You can run tshark with option -V and then parse the full output of the DNS response.
or parse the 'text' field of the DNS responses.
Regards answered 21 Nov '12, 10:28 Kurt Knochner ♦ edited 21 Nov '12, 10:35 |