tcpdump 识别成dns_dns tcpdump

查看本机dns服务器配置

root@php56:/home/tb# cat /etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)

# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

nameserver 10.70.1.38

nameserver 10.70.1.39

root@php56:/home/tb#

利用host命令执行操作

root@php56:/home/tb# host -t A WWW.BAIDU.COM

www.baidu.com is an alias for www.a.shifen.com.

www.a.shifen.com has address 14.215.177.39

www.a.shifen.com has address 14.215.177.38

root@php56:/home/tb#

抓包命令及结果

root@php56:/home/tb# tcpdump -i enp0s3 -nt -s 500 port domain

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on enp0s3, link-type EN10MB (Ethernet), capture size 500 bytes

IP 10.70.30.60.35117 > 10.70.1.38.53: 13616+ A? WWW.BAIDU.COM. (31)

IP 10.70.1.38.53 > 10.70.30.60.35117: 13616 3/0/0 CNAME www.a.shifen.com., A 14.215.177.39, A 14.215.177.38 (90)

简短解释

tcpdump 以 ip地址.端口号标识通信的某一端

以">"表示数据传输方向

10.70.1.38是本机首选dns服务器，可见53是dns服务器端口

13616为查询标识，对应response的13616

13616后的+号代表是递归(注意和迭代区分)

A?表示使用A类型的查询方式

最后的31为dns查询报文的长度

3/0/0 分别代表3个应答资源记录，0个授权记录和0个额外信息记录，最后的90为响应字节长度

More:tcpdump -x选项(可以看到dns每个字节)

root@php56:/home/tb# tcpdump -i enp0s3 -ntx -s 500 port domain

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on enp0s3, link-type EN10MB (Ethernet), capture size 500 bytes

IP 10.70.30.60.50417 > 10.70.1.38.53: 52136+ A? WWW.BAIDU.COM. (31)

0x0000: 4500 003b cf8e 0000 4011 7736 0a46 1e3c

0x0010: 0a46 0126 c4f1 0035 0027 3426 cba8 0100

0x0020: 0001 0000 0000 0000 0357 5757 0542 4149

0x0030: 4455 0343 4f4d 0000 0100 01

IP 10.70.1.38.53 > 10.70.30.60.50417: 52136 3/0/0 CNAME www.a.shifen.com., A 220.181.38.150, A 220.181.38.149 (90)

0x0000: 4500 0076 0000 4000 3f11 078a 0a46 0126

0x0010: 0a46 1e3c 0035 c4f1 0062 4ef4 cba8 8180

0x0020: 0001 0003 0000 0000 0377 7777 0562 6169

0x0030: 6475 0363 6f6d 0000 0100 01c0 0c00 0500

0x0040: 0100 0003 b400 0f03 7777 7701 6106 7368

0x0050: 6966 656e c016 c02b 0001 0001 0000 0030

0x0060: 0004 dcb5 2696 c02b 0001 0001 0000 0030

0x0070: 0004 dcb5 2695

参考字段说明