Filter DNS queries without matched responses

Question

I receive seldom messages during stress test about timed out DNS requests from c-ares used in download manager as part of libcurl. I have huge pcap and need to identify such failed DNS queries. Is it possible with Wireshark's expression language?

Accepted Answer

Perhaps the following as a Wireshark display filter will work:

dns && (dns.flags.response == 0) && ! dns.response_in

(Hat tip to what I think was a recent ask.wireshark.org answer (that I can't find right now)).

You can also use tshark -2 -R "dns && (dns.flags.response == 0) && ! dns.response_in" ...

(You may have to adjust the quoting depending upon the OS/shell you are using.

Update: A test using this filter with the latest 1.8 tshark seemed to sort of work. A DNS query without a response was found but, for some reason, the frame number was incorrect. (I.e. the frame found by wireshark using the filter was the same as that found by tshark, but tshark showed a different (incorrect) frame number).

I've filed Bug #8316 at bugs.wireshark.org.

Answer 2

To troubleshoot unsuccessful DNS query:

Browse to Domain Name System > Flags, last line is the reply code, the 0 of which means no error. Others are listed down according to iana.org: http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml

RCODE Name Description Reference 0 NoError No Error [RFC1035] 1 FormErr Format Error [RFC1035] 2 ServFail Server Failure [RFC1035] 3 NXDomain Non-Existent Domain [RFC1035] 4 NotImp Not Implemented [RFC1035] 5 Refused Query Refused [RFC1035] 6 YXDomain Name Exists when it should not [RFC2136][RFC6672] 7 YXRRSet RR Set Exists when it should not [RFC2136] 8 NXRRSet RR Set that should exist does not [RFC2136] 9 NotAuth Server Not Authoritative for zone [RFC2136] 9 NotAuth Not Authorized [RFC2845] 10 NotZone Name not contained in zone [RFC2136] 11-15 Unassigned
16 BADVERS Bad OPT Version [RFC6891] 16 BADSIG TSIG Signature Failure [RFC2845] 17 BADKEY Key not recognized [RFC2845] 18 BADTIME Signature out of time window [RFC2845] 19 BADMODE Bad TKEY Mode [RFC2930] 20 BADNAME Duplicate key name [RFC2930] 21 BADALG Algorithm not supported [RFC2930] 22 BADTRUNC Bad Truncation [RFC4635] 23 BADCOOKIE Bad/missing Server Cookie [RFC7873] 24-3840 Unassigned
3841-4095 Reserved for Private Use [RFC6895] 4096-65534 Unassigned
65535 Reserved, can be allocated by Standards Action [RFC6895]

You can use the expression:

(!(dns.flags.rcode==0))&&(dns.flags.response==1)

-- !(dns.flags.rcode==0) means the reply code does not match "no error" -- dns.flags.response==1 means match all the query answer packet.

Test if this work, start Wireshark capture, open a command window, ping a non exist website, like ping www.gggoogeld.com. Then stop the capture, apply the expression in the display filter, see if the unsuccessful query been listed and only that is listed.