tanyjin123 / dns_parse Goto Github PK

-- OVERVIEW --
dns_parse takes as input a pcap of DNS data and produces a complete, trivially
parsable, human readable ASCII version of the same data. It's generally useful
for network monitoring (send the data to Splunk or similar). The most common
carrying protocols are supported, as well as packet deduplication.

-- SUPPORTED PROTOCOLS --
Ethernet
MPLS
IPv4 (including fragment reassembly)
IPv6 (including fragment reassembly)
UDP
TCP (with flow state saving and loading between pcaps)
DNS (on any port)

-- AUTHOR INFO --
Paul Ferrell
[email protected]

-- CONTENTS --
Code to build bin/dns_parse.
init/dnscapture - An init script for running tcpdump on an interface as a
service to generate regular pcap files.
bin/dns_parse_cron - A python cron job script for periodically running dns_parse
on regularly output pcap files (generally from using the -C or -G options in
tcpdump).
pkgs/dns_parse.spec - An RPM spec file, for those dinosaurs that still use these
things (like me).
etc/* - example config files for init/dnscapture and bin/dns_parse_cron

-- DEPENDENCIES --
libpcap

-- OS Dependencies --
This has been tested primarily on x86_64 linux, but there shouldn't be any typing issues on 32 bit machines. 

-- BUILDING AND INSTALLING --
make
make install

-- Running --
"./bin/dns_parse -h" should tell you everything you need to know.

A reasonable set of options is:
./bin/dns_parse -m "" -t -r <dns_captured.pcap>
This gets you newline separated resource records an empty main record separator,
pretty printed dates, and the shorthand for the record types (ie. A or CNAME).
Printing of additional and name server records is disabled (by default).
The output will look like this:

2013-02-13 14:56:06.002102,75.32.12.33,75.32.37.16,61,u,r,AA
? mass.blah.com A
! mass.blah.com A 75.32.37.40

2013-02-13 14:56:06.002471,33.53.3.59,112.78.117.89,54,u,q,NA
? getsystemsinc.com MX

2013-02-13 14:56:06.005718,75.32.207.52,75.32.12.33,53,u,q,NA
? 11.207.165.128.in-addr.arpa PTR

2013-02-13 14:56:06.006109,75.32.12.33,75.32.207.52,80,u,r,AA
? 11.207.165.128.in-addr.arpa PTR
! 11.207.165.128.in-addr.arpa PTR cato.blah.com

2013-02-13 14:56:06.006189,75.32.157.134,75.32.12.33,47,u,q,NA
? blerg-dd.blah.com A

2013-02-13 14:56:06.006212,192.12.184.7,33.53.3.1,42,u,q,NA
? api.flyertown.ca A

2013-02-13 14:56:06.006570,75.32.12.33,75.32.157.134,63,u,r,AA
? blerg-dd.blah.com A
! blerg-dd.blah.com A 172.16.236.126