The port number is not after a semicolon. The ports are in red below:
The rest I have to look at the tcpdump source for. I didn't see much explained in documentation.
The next number, 52313 is the DNS query ID which is used to differentiate queries. During the request this can be followed by a + or % to mean Recursion Disabled and Check Disabled bits are set, respectively. There are a few symbols that can be sent with the reply as well: AA*, RA-, TC|, AD$. Will have to look at the DNS RFC for those meanings.
What I was really curious of is that #/#/#. That seems to be the reply counts. AN/NS/AR (Answer, Nameserver, Additional Records).
The SOA record isn't really printed, just that it was in there, as "SOA", then all the A records which you see are the IPs associated.
Lastly you should have seen a (#) which would be the total length.
I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0.
I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
I wrote a short BASH script to run tcpdump and save the output to a log file for when I'm away from my desk. The script runs fine normally, but fails to start in cron. Any ideas?
#!/bin/bash
today=`date +%Y%m%d`
tcpdump -i eth0 -s 1500 -w ${today}.cap &
exit (5 Replies)
hello, i have a lot of pcap files (tcpdump output) that i want to compare.
every tcpdump output has two file, server and client.
what i want to do is:
1. take timestamp, source address, destination address, and packet id from each file (server and client)
2. find the packets sent from... (0 Replies)
i would like to know about tcpdump
i would like to use tcpdump to get information about these
- Date
- time
- source hostname
- source mac address
- source ip address
- destination ip address
- see outbound only
then i use command like this
tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
i would like to know about tcpdump
i would like to use tcpdump to get information about these
- Date
- time
- source hostname
- source mac address
- source ip address
- destination ip address
- see outbound only
then i use command like this
tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
i am trying to write a script to parse some tcpdump output, in each line of the tcpdump output, I know for sure there are 3 keywords exist:
User{different usernamehere}
NAS_ipaddr{different ip here}
Calling_station{ip or dns name here}
But the positions for these 3 keywords in the... (4 Replies)
Hi,
I am trying to capture manually crafted IP packets, created using Scapy, to a pcap file that can later be replayed using tcpreplay.
When using wireshark, I can successfully capture these packets and view them in wireshark.
However, when using tcpdump, these packets are then shown in... (2 Replies)
Hi.
Need Help with TcpDump
Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error
can anyone help me with this error ? Thanks alot !!:) (1 Reply)
I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies
LEARN ABOUT REDHAT
net::dns::nameserver
Net::DNS::Nameserver(3) User Contributed Perl Documentation Net::DNS::Nameserver(3)NAME
Net::DNS::Nameserver - DNS server class
SYNOPSIS
"use Net::DNS::Nameserver;"
DESCRIPTION
Instances of the "Net::DNS::Nameserver" class represent simple DNS server objects. See "EXAMPLE" for an example.
METHODS
new
my $ns = Net::DNS::Nameserver->new(
LocalAddr => "10.1.2.3",
LocalPort => "5353",
ReplyHandler => &reply_handler,
Verbose => 1
);
Creates a nameserver object. Attributes are:
LocalAddr IP address on which to listen. Defaults to INADDR_ANY.
LocalPort Port on which to listen. Defaults to 53.
ReplyHandler Reference to reply-handling subroutine. Required.
Verbose Print info about received queries. Defaults to 0 (off).
The ReplyHandler subroutine is passed the query name, query class, and query type. It must return the response code and references to
the answer, authority, and additional sections of the response. Common response codes are:
NOERROR No error
FORMERR Format error
SERVFAIL Server failure
NXDOMAIN Non-existent domain (name doesn't exist)
NOTIMP Not implemented
REFUSED Query refused
See RFC 1035 and the IANA dns-parameters file for more information:
ftp://ftp.rfc-editor.org/in-notes/rfc1035.txt
http://www.isi.edu/in-notes/iana/assignments/dns-parameters
The nameserver will listen for both UDP and TCP connections. On Unix-like systems, the program will probably have to run as root to listen
on the default port, 53. A non-privileged user should be able to listen on ports 1024 and higher.
Returns a Net::DNS::Nameserver object, or undef if the object couldn't be created.
See "EXAMPLE" for an example.
main_loop
$ns->main_loop;
Start accepting queries.
EXAMPLE
The following example will listen on port 5353 and respond to all queries for A records with the IP address 10.1.2.3. All other queries
will be answered with NXDOMAIN. Authority and additional sections are left empty.
#!/usr/bin/perl -Tw
use Net::DNS;
use strict;
sub reply_handler {
my ($qname, $qclass, $qtype) = @_;
my ($rcode, @ans, @auth, @add);
if ($qtype eq "A") {
my ($ttl, $rdata) = (3600, "10.1.2.3");
push @ans, Net::DNS::RR->new("$qname $ttl $qclass $qtype $rdata");
$rcode = "NOERROR";
}
else {
$rcode = "NXDOMAIN";
}
return ($rcode, @ans, @auth, @add);
}
my $ns = Net::DNS::Nameserver->new(
LocalPort => 5353,
ReplyHandler => &reply_handler,
Verbose => 1
);
if ($ns) {
$ns->main_loop;
}
else {
die "couldn't create nameserver object
";
}
BUGS
Net::DNS::Nameserver objects can handle only one query at a time.
COPYRIGHT
Copyright (c) 2000-2002 Michael Fuhr. All rights reserved. This program is free software; you can redistribute it and/or modify it under
the same terms as Perl itself.
SEE ALSO perl(1), Net::DNS, Net::DNS::Resolver, Net::DNS::Packet, Net::DNS::Update, Net::DNS::Header, Net::DNS::Question, Net::DNS::RR, RFC 1035
perl v5.8.0 2002-05-31 Net::DNS::Nameserver(3)