Sponsored Content
Special Forums Cybersecurity Need Help with this TCPDUMP output... Post 302908014 by RudiC on Thursday 3rd of July 2014 05:02:57 AM
Old 07-03-2014
I'd say it's not a query but the answer from a DNS server holding all the A records for a domain that has been queried.
 

10 More Discussions You Might Find Interesting

1. Programming

How To Use tcpdump

I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0. I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Discussion started by: chenhao_no1
2 Replies

2. UNIX for Dummies Questions & Answers

tcpdump

does anybody know what the -d -dd and -ddd options are used for ? thanks (2 Replies)
Discussion started by: ant04
2 Replies

3. Shell Programming and Scripting

Tcpdump in cron

I wrote a short BASH script to run tcpdump and save the output to a log file for when I'm away from my desk. The script runs fine normally, but fails to start in cron. Any ideas? #!/bin/bash today=`date +%Y%m%d` tcpdump -i eth0 -s 1500 -w ${today}.cap & exit (5 Replies)
Discussion started by: paulzeromi
5 Replies

4. Shell Programming and Scripting

analyzing tcpdump output

hello, i have a lot of pcap files (tcpdump output) that i want to compare. every tcpdump output has two file, server and client. what i want to do is: 1. take timestamp, source address, destination address, and packet id from each file (server and client) 2. find the packets sent from... (0 Replies)
Discussion started by: slumpia
0 Replies

5. Cybersecurity

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
Discussion started by: chamnanpol
0 Replies

6. IP Networking

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
Discussion started by: chamnanpol
2 Replies

7. Shell Programming and Scripting

write a script to parse some tcpdump output

i am trying to write a script to parse some tcpdump output, in each line of the tcpdump output, I know for sure there are 3 keywords exist: User{different usernamehere} NAS_ipaddr{different ip here} Calling_station{ip or dns name here} But the positions for these 3 keywords in the... (4 Replies)
Discussion started by: fedora
4 Replies

8. IP Networking

tcpdump vs. wireshark

Hi, I am trying to capture manually crafted IP packets, created using Scapy, to a pcap file that can later be replayed using tcpreplay. When using wireshark, I can successfully capture these packets and view them in wireshark. However, when using tcpdump, these packets are then shown in... (2 Replies)
Discussion started by: yotamhc
2 Replies

9. Debian

Tcpdump Help !

Hi. Need Help with TcpDump Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error can anyone help me with this error ? Thanks alot !!:) (1 Reply)
Discussion started by: SoulZB
1 Replies

10. IP Networking

TCPdump

I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies
ASKMARA(1)							      askmara								ASKMARA(1)

NAME
askmara - do simple dns queries DESCRIPTION
askmara queries the user-specified dns server for records, and outputs the reply in a csv2-compatible format (csv2 is the format of zone files that maradns uses). USAGE
askmara [-n] [-v|-t timeout] query [server] OPTIONS
-t If this is present, the following argument is the askmara timeout, in seconds. Note that askmara can not both have a user-defined timeout and verbose output. -v If this is set, askmara will verbosely output the complete reply that the server sent. Note that this verbose output is not csv2-compatible. -n If this is set, askmara, when sending out a query, will not request DNS recursion; in other words, askmara will request that the remote DNS server not contact other DNS servers to answer the query in question. query dns record to be queried. The query has two sections: The type of record we desire, and the hostname we want this record for. The type of query can have two forms: A one-letter mnemonic, or a numeric rtype followed by a colon. This is immediately concatenated by the full name of the host name we wish to look up. For example, to ask for the IP of 'example.com.', we can use the one-letter mnemonic, in the form 'Aexample.com.', or we can use the numeric RR followed by a colon, giving the query '1:example.com.' (since A has the record type of one). Note that the query name needs the trailing dot at the end. Askmara supports a handful one-letter mnemonics, as follows: A signifies a request for an A (ipv4 address) RR N signifies a NS RR C signifies that we are asking for a CNAME RR S signifies that we want a SOA RR P signifies that we want a PTR RR @ signifies that we mant a MX RR T signifies that we want a TXT RR Z signifies that we want to ask for all RRs. server IP address of the dns server to be queried. If no server is given, askmara will query 127.0.0.1. EXAMPLES
Asking the server with the ip 127.0.0.1 for the IP address of example.com: askmara Aexample.com. Asking the server with the ip 198.41.0.4 for the IP address of example.com: askmara Aexample.com. 198.41.0.4 Asking the server with the ip address 127.0.0.1 for the IP address of example.com, using the rr_number:query format: askmara 1:example.com. Asking the server with the ip address 127.0.0.1 for a SRV record. In particular, we ask for the "http over tcp" service for example.net. Since askmara doesn't have a mnemonic for SRV record types, we use the numeric code (33 for SRV): askmara 33:_http._tcp.example.net. Asking the server with the ip address 127.0.0.1 for the AAAA (ipv6 ip) record for example.net: askmara 28:example.net. Note that the output will be a raw DNS packet in both the SRV and AAAA examples. BUGS
When askmara is asked for an SOA record, the output of askmara closely resembles the format of a csv2 file, but can not be parsed as a csv2 file without modification. askmara outputs multi-chunk ("character-string") TXT records incorrectly (it only outputs the first chunk). SEE ALSO
maradns(8) http://www.maradns.org LEGAL DISCLAIMER
THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. AUTHOR
MaraDNS is written by Sam Trenholme. Jaakko Niemi used 5 minutes to roll this manpage together, which Sam has subsequently revised. January 2002 askmara ASKMARA(1)
All times are GMT -4. The time now is 05:52 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy