Matus UHLAR - fantomas
uhlar at fantomas.sk
Fri Sep 7 07:02:23 UTC 2018
>On Thu, Sep 6, 2018 at 5:56 PM John W. Blue <john.blue at rrcic.com> wrote:
>> So that file is full of nothing but queries and no responses which, sadly, is useless.
>> tcpdump -s0 -n -i eth0 port domain -w /tmp/domaincapture.pcap
>> You don't need all of the extra stuff because -s0 captures the full packet.
On 06.09.18 18:42, Alex wrote:
>This is the command I ran to produce the pcap file I sent:
># tcpdump -s0 -vv -i eth0 -nn -w domain-capture-eth0-090518.pcap udp
>dst port domain
and that is the problem. "dst port domain" captures packets going to DNS
servers, not responses coming back.
"-vv" and "-nn" are useless when producing packet capture and "-s0" is
default for some time. I often add "-U" so file is flushed wich each packet.
you can strip incoming queries by using filter
"(src host 68.195.XXX.45 and dst port domain) or (src port domain and dst host 68.195.XXX.45)"
>I should also mention that, while eth0 is the physical device, there
>is a bridge set up to support virtual machines (none of which were
>active). Hopefully that's not the reason! (real IP obscured).
not the reason, but using "-i br0" could be safer then.
Note that the IP was seen in packet capture you have published, not needed
to hide it now.
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin, 1759
More information about the bind-users