<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hey all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m looking to make the switch from ‘tcpdump’ to ‘dnscap’ for this years DITL.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, because we’re now hosting several TLD’s and not just .CA, I need to avoid submitting data for customer TLD’s.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It *<b>looks</b>* like this should be possible with ‘dnscap’, but it doesn’t seem to work in practice using either version 1.0 or version 1.7.1 (latest as per DNS-OARC website).<o:p></o:p></p>
<p class="MsoNormal">I am in by no way ruling out that I’m doing something wrong here, and/or misinterpreting the documentation.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The DNS-OARC DITL script “capture-dnscap.sh” says:<o:p></o:p></p>
<p class="MsoNormal"># ** Destinations **<o:p></o:p></p>
<p class="MsoNormal"># If you want to select traffic directed to a specific address<o:p></o:p></p>
<p class="MsoNormal"># add it here<o:p></o:p></p>
<p class="MsoNormal">DESTINATIONS="any.ca-servers.ca"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…which, when I run “capture-dnscap.sh”, gives me a dnscap syntax as such:<o:p></o:p></p>
<p class="MsoNormal">Executing '/usr/local/bin/dnscap -t 600 -w ./col01.lhr.ca-servers.ca -m qun -i eth1 -z any.ca-servers.ca -s i -6 -T -f'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So it’s utilizing the “-z” flag with my DESTINATIONS setting. The ‘dnscap’ manual says:<o:p></o:p></p>
<p class="MsoNormal"> -z host Capture only transactions having these responders. Can be specified more than once to select multiple respon-<o:p></o:p></p>
<p class="MsoNormal"> ders. If a host name is used, then all of that host’s addresses whether IPv4 or IPv6 are added to the recogni-<o:p></o:p></p>
<p class="MsoNormal"> tion pattern.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, when I attempt to verify that I’m not leaking customer data, I see:<o:p></o:p></p>
<p class="MsoNormal">[root@col01 scripts]# tcpdump -nr /tmp/col01.lhr.ca-servers.ca.20180202.185721.945211 not host 199.4.144.2 and not host 2001:500:A7::2 |grep 185.159.197.1 |head -5<o:p></o:p></p>
<p class="MsoNormal">reading from file /tmp/col01.lhr.ca-servers.ca.20180202.185721.945211, link-type RAW (Raw IP)<o:p></o:p></p>
<p class="MsoNormal">13:57:22.020123 IP 185.159.197.100 > 188.166.18.244: udp<o:p></o:p></p>
<p class="MsoNormal">13:57:22.058056 IP 185.159.197.100 > 138.68.93.203: udp<o:p></o:p></p>
<p class="MsoNormal">13:57:22.192434 IP 185.159.197.100 > 207.154.216.38: udp<o:p></o:p></p>
<p class="MsoNormal">13:57:22.281961 IP 185.159.197.100 > 138.68.180.5: udp<o:p></o:p></p>
<p class="MsoNormal">13:57:22.317448 IP 185.159.197.100 > 138.68.180.5: udp<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If anyone can spot what I’m doing wrong, offer advice, and/or replicate my findings…please let me know.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks all,<o:p></o:p></p>
<p class="MsoNormal">-Jacob Zack<o:p></o:p></p>
<p class="MsoNormal">DNS Architect – CIRA (.CA TLD)<o:p></o:p></p>
</div>
</body>
</html>