gopacket解析DNS协议

最新推荐文章于 2025-01-03 11:08:42 发布

jj吉吉国王

最新推荐文章于 2025-01-03 11:08:42 发布

阅读量1.9k

点赞数 1

分类专栏： Go相关 gopacket UDP 文章标签： gopacket DNS

本文链接：https://blog.csdn.net/qq_27333977/article/details/100016978

版权

Go相关同时被 3 个专栏收录

4 篇文章 0 订阅

订阅专栏

gopacket

4 篇文章 0 订阅

订阅专栏

UDP

1 篇文章 0 订阅

订阅专栏

通过gopacket解析DNS请求协议。
在这里插入图片描述
读取单个数据包，IP层ID为19777。
读取19777数据包DNS协议的TransactionID

package main

import (
	"fmt"
	"time"

	"github.com/google/gopacket/layers"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

func main() {

	start := time.Now()
	//some func or operation

	handle, _ := pcap.OpenOffline("dns.pcap")
	defer handle.Close()
	packetSource := gopacket.NewPacketSource(
		handle,
		handle.LinkType(),
	)

	var length = 0
	for packet := range packetSource.Packets() {

		ipLayer := packet.Layer(layers.LayerTypeIPv4)

		if ipLayer != nil {
			ip, _ := ipLayer.(*layers.IPv4)
			dnsLayer := packet.Layer(layers.LayerTypeDNS)
			length = length + int(ip.Length) + 20
			if ip.Id == 19777 {
				dns, _ := dnsLayer.(*layers.DNS)
				fmt.Println(dns.ID)

			}

		}

	}
	fmt.Println("LEN:", length)
	cost := time.Since(start)
	fmt.Printf("cost=[%s]", cost)

}

在这里插入图片描述
结果为8408

获取其他内容

package main

import (
	"fmt"
	"time"

	"github.com/google/gopacket/layers"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

func main() {

	start := time.Now()
	//some func or operation

	handle, _ := pcap.OpenOffline("dns.pcap")
	defer handle.Close()
	packetSource := gopacket.NewPacketSource(
		handle,
		handle.LinkType(),
	)

	var length = 0
	for packet := range packetSource.Packets() {

		ipLayer := packet.Layer(layers.LayerTypeIPv4)

		if ipLayer != nil {
			ip, _ := ipLayer.(*layers.IPv4)
			dnsLayer := packet.Layer(layers.LayerTypeDNS)
			length = length + int(ip.Length) + 20

			if ip.Id == 19777 || ip.Id == 65326 {
				dns, _ := dnsLayer.(*layers.DNS)
				fmt.Println("dnsID:", dns.ID)
				fmt.Println("answers:", dns.ANCount)
				fmt.Println("是否是回应包：", dns.QR) //false查询、true回应
				fmt.Println("Queries:", string(dns.Questions[0].Name))
				//Answers
				for _, v := range dns.Answers {
					//fmt.Println("Answers:", v.String())
					fmt.Println("Answers:", v.String())
					fmt.Println("Answers-name:", v.Type)
				}
				fmt.Println("===========")
			}

		}

	}

	fmt.Println("LEN:", length)
	cost := time.Since(start)
	fmt.Printf("cost=[%s]", cost)

}

在这里插入图片描述
另一种写法

package main

import (
	"fmt"
	"time"

	"github.com/google/gopacket/layers"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

func main() {

	start := time.Now()
	//some func or operation

	handle, _ := pcap.OpenOffline("dns.pcap")
	defer handle.Close()
	packetSource := gopacket.NewPacketSource(
		handle,
		handle.LinkType(),
	)

	var length = 0

	//	创建所有所需的变量
	var eth layers.Ethernet
	var ip4 layers.IPv4
	var udp layers.UDP
	var dns layers.DNS
	parser := gopacket.NewDecodingLayerParser(
		layers.LayerTypeEthernet, &eth, &ip4, &udp, &dns)
	decodedLayers := []gopacket.LayerType{}
	//	解析
	for packet := range packetSource.Packets() {
		parser.DecodeLayers(packet.Data(), &decodedLayers)
		if ip4.Id == 19777 || ip4.Id == 65326 {
			fmt.Println("dnsID:", dns.ID)
			fmt.Println("answers:", dns.ANCount)
			fmt.Println("是否是回应包：", dns.QR) //false查询、true回应
			fmt.Println("Queries:", string(dns.Questions[0].Name))
			//Answers
			for _, v := range dns.Answers {
				//fmt.Println("Answers:", v.String())
				fmt.Println("Answers:", v.String())
				fmt.Println("Answers-name:", v.Type)
			}
			fmt.Println("===========")

		}
	}

	fmt.Println("LEN:", length)
	cost := time.Since(start)
	fmt.Printf("cost=[%s]", cost)

}