Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Strange reverse (client/server) Im seeing - quick fix
- Loading branch information
gamelinux
committed
Dec 2, 2011
1 parent
0c0ed60
commit aa917c7
Showing
2 changed files
with
6 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,32 +1,6 @@ | ||
|
||
# PassiveDNS | ||
|
||
* Get main code up and running. | ||
** "catch" DNS traffic! | ||
|
||
* Decode DNS server reply packet | ||
|
||
* Output: timestamp||sensor||ns-server-ip||NAME||TYPE||CLASS||TTL||*RDLENGTH*||RDATA | ||
** NAME Name of the node to which this record pertains (variable) | ||
** TYPE Type of RR in numeric form (e.g. 15 for MX RRs) 2 | ||
** CLASS Class code 2 | ||
** TTL Count of seconds that the RR stays valid (The maximum is 231-1, which is about 68 years.) 4 | ||
# ** RDLENGTH Length of RDATA field 2 | ||
** RDATA Additional RR-specific data (variable) | ||
|
||
|
||
# ref: http://en.wikipedia.org/wiki/List_of_DNS_record_types | ||
for answer in dns.an: | ||
if answer.type == 5: | ||
print "CNAME request", answer.name, "\tresponse", answer.cname | ||
elif answer.type == 1: | ||
print "A request", answer.name, "\tresponse", socket.inet_ntoa(answer.rdata) | ||
elif answer.type == 28: | ||
print "AAAA request", answer.name, "\tresponse", socket.inet6_ntoa(answer.rdata) | ||
elif answer.type == 12: | ||
print "PTR request", answer.name, "\tresponse", answer.ptrname | ||
else | ||
print "Parsing of R-Type", answer.type, "is not yet implemented..." | ||
|
||
|
||
|
||
* Implement comandline option for log filename | ||
* Clean up memory on exit | ||
* Add some stats |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters