This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a way to use TShark to extract TCP/UDP DNS queries and end up with a list of the original query and query type in letter format?

Right now my command looks like this:

tshark -n -r capture.pcap -T fields -e dns.qry.name -e dns.qry.type -Y '( udp.port==53 || tcp.port==53 ) && dns.flags.response==0'

What it generates is a file of query names with a tab and then a number of the query type. I then have to cat the file and SED looking for a combination of a <tab> plus the query type number to replace it with a <tab> and the right letter query - i.e., A is 1, CNAME is 5, AAAA is 2, etc.

My goal is to come up with a list of domains I can replay against a DNS server using queryperf or dig.

asked 28 Oct '14, 19:43

JerimiahF's gravatar image

JerimiahF
1112
accept rate: 0%


My goal is to come up with a list of domains

Then you could try this:

tshark -nr capture.pcap -V -Y "dns" | grep "Name:" | awk '{print $2}' | sort -u

Regards
Kurt

permanent link

answered 29 Oct '14, 04:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 29 Oct '14, 05:02

Kurt - thanks for answering.

The challenge I have though is that besides the DNS name, I also need the type of record asked for either with a TAB or space between it so the list would look like this:

www.apple.com A

Queryperf (the faster and preferred tool) needs both pieces in order to do the query and ensure its asking the same request as the capture did.

(29 Oct '14, 05:37) JerimiahF
1

O.K. then try this:

tshark.exe -nr c:\temp\dns.pcap -V | grep ": type" | awk '{print $1 $3}'

Please add some 'sed magic' to remove the : and ,. I leave that up to you ;-)

(29 Oct '14, 05:47) Kurt Knochner ♦

Wow - simple yet VERY effective. This is perfect! Thanks Kurt!!!

Difference of before/after is now a 150MB capture with ~240k of queries - now processes in about 1/3 the time and thus is far less complex of the SED hell I was going thru before with some massive -V dumps to parse thru.

(29 Oct '14, 07:26) JerimiahF
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×109
×14
×12

question asked: 28 Oct '14, 19:43

question was seen: 8,240 times

last updated: 29 Oct '14, 07:26

p​o​w​e​r​e​d by O​S​Q​A