Skip to content

Instantly share code, notes, and snippets.

@boina-n

boina-n/TsharkDnsPacket.sh

Created October 22, 2017 16:08
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save boina-n/0bb5ac4d6bca329a133cff705f2df68c to your computer and use it in GitHub Desktop.
Save boina-n/0bb5ac4d6bca329a133cff705f2df68c to your computer and use it in GitHub Desktop.
Download ZIP
Tshark a DNS Packet
Raw
TsharkDnsPacket.sh
$ wc -l ok.cleaning_center.pcap.20151201.19h01m17s-1448992877.645994-1448992920.921620.v.1.txt
8994730 ok.cleaning_center.pcap.20151201.19h01m17s-1448992877.645994-1448992920.921620.v.1.txt
From resperf source: https://github.com/cobblau/dnsperf
static char *qtypes[] = {"A", "NS", "MD", "MF", "CNAME", "SOA", "MB", "MG",
"MR", "NULL", "WKS", "PTR", "HINFO", "MINFO", "MX", "TXT",
"AAAA", "SRV", "NAPTR", "A6", "AXFR", "MAILB", "MAILA", "*", "ANY"};
input=/mnt/nas/data/tcpreplay/nominal/ok.cleaning_center.pcap.20151201.19h01m17s-1448992877.645994-1448992920.921620.ano
output=ok.cleaning_center.pcap.20151201.19h01m17s-1448992877.645994-1448992920.921620.txt
tshark -R "dns.qry.type==A || dns.qry.type==NS || dns.qry.type==MD || dns.qry.type==MF || dns.qry.type==CNAME || dns.qry.type==SOA || dns.qry.type==MB || dns.qry.type==MG || dns.qry.type==MR || dns.qry.type==NULL || dns.qry.type==WKS || dns.qry.type==PTR || dns.qry.type==HINFO || dns.qry.type==MINFO || dns.qry.type==MX || dns.qry.type==TXT || dns.qry.type==AAAA || dns.qry.type==SRV || dns.qry.type==NAPTR || dns.qry.type==A6 || dns.qry.type==AXFR || dns.qry.type==MAILB || dns.qry.type==MAILA || dns.qry.type==ANY" -r $input -T text | awk --re-interval '$(NF) ~ /[a-zA-Z0-9_-]{1,63}\.?+([a-zA-Z]{2,})/ && $(NF-1) ~ /^(A|NS|MD|MF|CNAME|SOA|MB|MG|MR|NULL|WKS|PTR|HINFO|MINFO|MX|TXT|AAAA|SRV|NAPTR|A6|AXFR|MAILB|MAILA|ANY)$/ { print $(NF) " " $(NF-1) } ' > $output
tshark -R "dns.qry.type==A || dns.qry.type==NS || dns.qry.type==MD || dns.qry.type==MF || dns.qry.type==CNAME || dns.qry.type==SOA || dns.qry.type==MB || dns.qry.type==MG || dns.qry.type==MR || dns.qry.type==NULL || dns.qry.type==WKS || dns.qry.type==PTR || dns.qry.type==HINFO || dns.qry.type==MINFO || dns.qry.type==MX || dns.qry.type==TXT || dns.qry.type==AAAA || dns.qry.type==SRV || dns.qry.type==NAPTR || dns.qry.type==A6 || dns.qry.type==AXFR || dns.qry.type==MAILB || dns.qry.type==MAILA || dns.qry.type==ANY" -r $input -T text | awk --re-interval '$(NF) ~ /^(([a-zA-Z0-9_-]{1,63})\.{1}(\.{0}[a-zA-Z0-9_-]{0,63}){0,}(\.[a-zA-Z]{1,}))*$/ { print $(NF) " " $(NF-1) }' > $output
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment