search

KimiNewt / pyshark

Python wrapper for tshark, allowing python packet parsing using wireshark dissectors
MIT License
2.23k stars 422 forks source link

get all dns answers from a dns packet #682

Open amirfirouzi opened 9 months ago

amirfirouzi commented 9 months ago

Hello Everyone,

I'm using Pyshark to parse different types of packets.

For some reason, I cannot get all the DNS answers. there are two issues, first, not all answers are available to get. I have a packet which shows 4 different Answers in Wireshark, but only one answer is shown in the dns.Answers object, or have another packet which has 11 answers in Wireshark, but only 3 are showing in the object. The second issue is a unique and stable way to get the answers. for some packets, I can get the only answer using answer = getattr(dns.Answers, dns.Answers.field_names[0]). But for packets with more answers, this doesn't work. and I need to get all dns.Answers.field_names, and loop through them to see which one is a domain, sample result might be like this: ['net', 'e28578.d.akamaiedge.net', 'assets.msn.com', 'assets.msn.com.edgekey.net', 'com'] and I need to discard .net and .com entries, and get the name of the domains and access the actual answer object.

Not sure if I'm doing something wrong here or this is a bug, or... Looked in the wiki and searched I the web but couldn't find anything.

Appreciate your help.

ar1ocker commented 8 months ago

I ran into the same problem and didn't find the answers anywhere either, decided through this dirty hack for A responses

for i in dns_responses:
     text = '\n'.join([c for c in i.dns._get_all_field_lines()])
     a = re.findall('(?<=addr )\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', text)
     print(a)
johnbumgarner commented 4 months ago

Look at the DNS parsing in this example and let me know if it helps. Also review the DNS Query Types in the comments. You can parses these as needed.

https://github.com/johnbumgarner/pyshark_usage_overview/blob/master/examples/dns_filtering_examples.py