[dns-operations] Tools to assemble fragments

[Matthäus Wander]

Here's a Python 2.7 tool I've used to chew on 240 GBytes of .pcap files:
https://www.vs.uni-due.de/wander/reassemble_dns/

reassemble_write.py reads 1 to n .pcap files, extracts DNS messages and
writes a binary .dns file with all DNS messages. It supports IPv4, IPv6,
UDP and TCP. IP fragments and TCP streams are reassembled.
Depends on dpkt (https://github.com/kbandla/dpkt).

You can use dns_parser.py to parse the .dns file. Depends on dnspython
(www.dnspython.org).
Or implement a parser on your own. The file format is documented in
dns_file_format.txt.

Usage:
> python reassemble_write.py input.pcap output.dns
> python dns_parser.py output.dns

Regards,
Matt

RunxiaWan wrote on 2016-05-18 08:50:
> Hi, everyone,
> 
> I am doing a data analysis work for the queries and responses captured
> in my recursive server. I find the DNS data has some fragments due to
> large DNS packageand it is tricky to assemble them. Would anyone tell me
> any works of assembling IP layer fragments or any tools to parse DNS
> message from tcpdump/dnscap data?
> 
> 
> 
> Best
> 
> Runxia Wan
> 
> 
> ---------------
> Runxia Wan(Brian)
> 
> Research Engineer
> BII Lab
> 
> Beijing Internet Institute(BII)
> 
> _____rxwan at biigroup.cn_<mailto:rxwan at biigroup.cn>
> 
> 
> 
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
> 



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5523 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20160519/7585ba62/attachment.bin>