search

gamelinux / passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup
http://gamelinux.org/
1.67k stars 374 forks source link

Total DNS records allocated is 0？ #100

Open IDJack opened 6 years ago

IDJack commented 6 years ago

I use tcpdump to collect the dns traffic between the local DNS server and hosts in our university(not include the dns traffic between the local DNS server and upper DNS server) and store as pcap format.

I use passivedns1.0 to process the dns traffic. But there are some errors. Why the total DNS records allocated is zero? Why？

[] PassiveDNS 1.0 [] By Edward Bjarte Fjellskål edward.fjellskaal@gmail.com [] Using libpcap version 1.7.4 [] Using ldns version 1.6.17 [*] Reading from file /home/jack/dnscap/data/20171106_00.pcap

-- Total DNS records allocated : 0 -- Total DNS assets allocated : 0 -- Total DNS packets over IPv4/TCP : 1943 -- Total DNS packets over IPv6/TCP : 0 -- Total DNS packets over TCP decoded : 0 -- Total DNS packets over TCP failed : 1943 -- Total DNS packets over IPv4/UDP : 1229462 -- Total DNS packets over IPv6/UDP : 0 -- Total DNS packets over UDP decoded : 0 -- Total DNS packets over UDP failed : 1229462 -- Total packets received from libpcap : 1969978 -- Total Ethernet packets received : 1969978 -- Total VLAN packets received : 0

[*] passivedns ended.

gamelinux commented 6 years ago

Would need to look at query+answer from the pcap....