• Start
• Documentation
  • PostgreSQL
  • mnoGoSearch
  • Apache 2.4
  • FreeBSD handbook
  • FreeBSD Manual
  • FreeBSD Source
• Tools
• Search
• Protected Area

plain

FreeBSD manual

keyword 1 2 3 4 5 6 7 8 9 n l

download PDF document: ldns-dpa.1.pdf

dpa(1) FreeBSD General Commands Manual dpa(1)
NAME dpa - DNS Packet Analyzer. Analyze DNS packets in ip trace files
SYNOPSIS dpa [ OPTION ] TRACEFILE

DESCRIPTION dpa is used to analyze dns packets in trace files. It has 3 main options: count, filter, and count uniques (i.e. count all different occurrences).

OPTIONS -c expressionlist Count occurrences of matching expressions

-f expression Filter: only process packets that match the expression

-h Show usage

-p Show the total number of correct DNS packets, and percentage of -u and -c values (of the total of matching on the -f filter. if no filter is given, percentages are on all correct dns packets)

-of file Write all packets that match the -f flag to file, as pcap data.

-ofh file Write all packets that match the -f flag to file, in hexadecimal format, readable by drill.

-s Show possible match names

-s matchname show possible match operators and values for name

-sf Only evaluate packets (in representation format) that match the -f filter. If no -f was given, evaluate all correct dns packets.

-u matchnamelist Count every occurrence of every value of the matchname (for instance, count all packetsizes, see EXAMPLES in ldns-dpa(1) ).

-ua For every matchname in -u, show the average value of all
-um number Only show the results from -u for values that occurred more than <number> times.

-v level Set verbosity to level (1-5, 5 being the highest). Mostly used for debugging.

-notip file Write packets that were not recognized as IP packets to file (as pcap data).

-baddns file Write dns packets that were too mangled to parse to file (as pcap data).

-version Show version and exit

LIST AND MATCHES A <matchnamelist> is a comma separated list of match names (use -s to see possible match names). A <expressionlist> is a comma separated list of expressions.
An expression has the following form: <expr>: (<expr>) <expr> | <expr> <expr> & <expr> <match>
<match>: <matchname> <operator> <value>
<operator>: = equal to <value> != not equal to <value> > greater than <value> < lesser than <value> >= greater than or equal to <value> <= lesser than or equal to <value> ~= contains <value>
See the -s option for possible matchnames, operators and values.

EXAMPLES ldns-dpa -u packetsize -p test.tr Count all different packetsizes in test.tr and show the percentages.

ldns-dpa -f "edns=1&qr=0" -of edns.tr test.tr Filter out all edns enable queries in test.tr and put them in edns.tr

ldns-dpa -f edns=1 -c tc=1 -u rcode test.tr For all edns packets, count the number of truncated packets and all their rcodes in test.tr.
ldns-dpa -u packetsize -ua test.tr Show all packet sizes and the average packet size per packet.

ldns-dpa -u srcaddress -uac test.tr Show all packet source addresses and the average number of packets sent from this address.

sudo tcpdump -i eth0 -s 0 -U -w - port 53 | ldns-dpa -f qr=0 -sf Print all query packets seen on the specified interface.


AUTHOR Written by Jelte Jansen for NLnetLabs.

REPORTING BUGS Report bugs to <dns-team@nlnetlabs.nl>.

COPYRIGHT Copyright (C) 2005 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
1 Nov 2005 dpa(1)