[dns-operations] Tools to assemble fragments

Matthäus Wander matthaeus.wander at uni-due.de
Thu May 19 20:46:03 UTC 2016

Here's a Python 2.7 tool I've used to chew on 240 GBytes of .pcap files:

reassemble_write.py reads 1 to n .pcap files, extracts DNS messages and
writes a binary .dns file with all DNS messages. It supports IPv4, IPv6,
UDP and TCP. IP fragments and TCP streams are reassembled.
Depends on dpkt (https://github.com/kbandla/dpkt).

You can use dns_parser.py to parse the .dns file. Depends on dnspython
Or implement a parser on your own. The file format is documented in

> python reassemble_write.py input.pcap output.dns
> python dns_parser.py output.dns


RunxiaWan wrote on 2016-05-18 08:50:
> Hi, everyone,
> I am doing a data analysis work for the queries and responses captured
> in my recursive server. I find the DNS data has some fragments due to
> large DNS packageand it is tricky to assemble them. Would anyone tell me
> any works of assembling IP layer fragments or any tools to parse DNS
> message from tcpdump/dnscap data?
> Best
> Runxia Wan
> ---------------
> Runxia Wan(Brian)
> Research Engineer
> BII Lab
> Beijing Internet Institute(BII)
> _____rxwan at biigroup.cn_<mailto:rxwan at biigroup.cn>
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5523 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20160519/7585ba62/attachment.bin>

More information about the dns-operations mailing list