DNSPKTFLOW(1p)						User Contributed Perl Documentation					    DNSPKTFLOW(1p)

NAME

       dnspktflow - Analyze and draw DNS flow diagrams from a tcpdump file

SYNOPSIS

	 dnspktflow -o output.png file.tcpdump

	 dnspktflow -o output.png -x -a -t -q file.tcpdump

DESCRIPTION

       The dnspktflow application takes a tcpdump network traffic dump file, passes it through the tshark application and then displays the
       resulting DNS packet flows in a "flow-diagram" image.  dnspktflow can output a single image or a series of images which can then be shown
       in sequence as an animation.

       dnspktflow was written as a debugging utility to help trace DNS queries and responses, especially as they apply to DNSSEC-enabled lookups.

REQUIREMENTS

       This application requires the following Perl modules and software components to work:

	 graphviz		   (http://www.graphviz.org/)
	 GraphViz		   (Perl module)
	 tshark 		   (http://www.wireshark.org/)

       The following is required for outputting screen presentations:

	 MagicPoint		   (http://member.wide.ad.jp/wg/mgp/)

       If the following modules are installed, a GUI interface will be enabled for communication with dnspktflow:

	 QWizard		   (Perl module)
	 Getopt::GUI::Long	   (Perl module)

OPTIONS

       dnspktflow takes a wide variety of command-line options.  These options are described below in the following functional groups:	input
       packet selection, output file options, output visualization options, graphical options, and debugging.

   Input Packet Selection
       These options determine the packets that will be selected by dnspktflow.

       -i STRING
       --ignore-hosts=STRING
	   A regular expression of host names to ignore in the query/response fields.

       -r STRING
       --only-hosts=STRING
	   A regular expression of host names to analyze in the query/response fields.

       -f
       --show-frame-num
	   Display the packet frame numbers.

       -b INTEGER
       --begin-frame=INTEGER
	   Begin at packet frame NUMBER.

   Output File Options
       These options determine the type and location of dnspktflow's output.

       -o STRING
       --output-file=STRING
	   Output file name (default: out%03d.png as PNG format.)

       --fig
	   Output format should be fig.

       -O STRING
       --tshark-out=STRING
	   Save tshark output to this file.

       -m
       --multiple-outputs
	   One picture per request (use %03d in the filename.)

       -M STRING
       --magic-point=STRING
	   Saves a MagicPoint presentation for the output.

   Output Visualization Options:
       These options determine specifics of dnspktflow's output.

       --layout-style
	   Selects the graphviz layout style to use (dot, neato, twopi, circo, or fdp).

       -L
       --last-line-labels-only
	   Only show data on the last line drawn.

       -z INTEGER
       --most-lines=INTEGER
	   Only show at most INTEGER connections.

       -T
       --input-is-tshark-out
	   The input file is already processed by tshark.

   Graphical Options:
       These options determine fields included in dnspktflow's output.

       -t
       --show-type
	   Shows message type in result image.

       -q
       --show-queries
	   Shows query questions in result image.

       -a
       --show-answers
	   Shows query answers in result image.

       -A
       --show-authoritative
	   Shows authoritative information in result image.

       -x
       --show-additional
	   Shows additional information in result image.

       -l
       --show-label-lines
	   Shows lines attaching labels to lines.

       --fontsize=INTEGER
	   Font Size

   Debugging:
       These options may assist in debugging dnspktflow.

       -d
       --dump-pkts
	   Dump data collected from the packets.

       -h
       --help
	   Show help for command line options.

COPYRIGHT

       Copyright 2004-2012 SPARTA, Inc.  All rights reserved.  See the COPYING file included with the DNSSEC-Tools package for details.

AUTHOR

       Wes Hardaker <hardaker@users.sourceforge.net>

SEE ALSO

       Getopt::GUI::Long(3) Net::DNS(3) QWizard.pm(3)

       http://dnssec-tools.sourceforge.net/

perl v5.14.2							    2012-06-21							    DNSPKTFLOW(1p)