[dns-operations] Tools to assemble fragments
matthaeus.wander at uni-due.de
Thu May 19 20:46:03 UTC 2016
Here's a Python 2.7 tool I've used to chew on 240 GBytes of .pcap files:
reassemble_write.py reads 1 to n .pcap files, extracts DNS messages and
writes a binary .dns file with all DNS messages. It supports IPv4, IPv6,
UDP and TCP. IP fragments and TCP streams are reassembled.
Depends on dpkt (https://github.com/kbandla/dpkt).
You can use dns_parser.py to parse the .dns file. Depends on dnspython
Or implement a parser on your own. The file format is documented in
> python reassemble_write.py input.pcap output.dns
> python dns_parser.py output.dns
RunxiaWan wrote on 2016-05-18 08:50:
> Hi, everyone,
> I am doing a data analysis work for the queries and responses captured
> in my recursive server. I find the DNS data has some fragments due to
> large DNS packageand it is tricky to assemble them. Would anyone tell me
> any works of assembling IP layer fragments or any tools to parse DNS
> message from tcpdump/dnscap data?
> Runxia Wan
> Runxia Wan(Brian)
> Research Engineer
> BII Lab
> Beijing Internet Institute(BII)
> _____rxwan at biigroup.cn_<mailto:rxwan at biigroup.cn>
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> dns-jobs mailing list
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 5523 bytes
Desc: S/MIME Cryptographic Signature
More information about the dns-operations