Ethereal-users: Re: [Ethereal-users] how to capture only DNSpackets byapplyingfilterin ethereal?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Sat, 21 Feb 2004 08:06:11 +1100
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Vadiraj Kulkarni wrote:
| hello,
| As i am only interested in DNS response packet, i am trying to apply
filters
| in Ethereal to capture.
| I have tried all the below commands. Still not working.
|
| Say:
| DNS is at 192.168.1.1
| Domain : abc.def.com
| My system : 192.168.1.10
|
| I am exuting command nslookup abc.def.com 192.168.1.1
|
| Filters applied
| 1). port 53 - Etehreal captures only DNS query packets from
192.168.1.10 to
| 192.168.1.1
| 2). udp port 53 - Same as above
| 3). udp src port 53 - Same as above
| 4). udp dst port 53 - Same as above
| 5). ip host 192.168.1.1 and udp port 53 - save as above
| 6). proto domain - Same as above
| 6). udp src port 53 - No packets captured. (This is what i am excepting.
| because DNS response will come from src port 53)
|
| Can anyone of try to run nslookup and tell me how to capture only DNS
| response?
|
| Thanks
| Vadiraj Kulkarni

Assuming you are only interested in UDP DNS traffic you could try

'port 53 and udp[2] & 0x80 == 0x80'

For TCP it looks like it should be

'port 53 and tcp[4] & 0x80 == 0x80'

Works for me.

- --
There's no point in being grown up if you can't be childish sometimes.
~                -- Dr. Who
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFANnbDUpRmj8xnsFgRAnntAKCYrupyHiRoPPGgDYHZWbB44FkD4ACfdMkb
jAELM92SDX+tIGp7eRylVrg=
=mTzx
-----END PGP SIGNATURE-----