search

gamelinux / passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup
http://gamelinux.org/
1.67k stars 374 forks source link

Failed UDP packets #109

Open robcza opened 5 years ago

robcza commented 5 years ago

I have an issue with failed UPD packets, although the traffic looks good to me and Wireshark also:

Therefore I don't think this is similar to this issue: https://github.com/gamelinux/passivedns/issues/106

The pcap has been anonymized by dnswasher, however the original pcap has exactly the same results. failedupd-anon.zip

passivedns -r ./failedudp-anon.pcap

[*] PassiveDNS 1.2.1
[*] By Edward Bjarte Fjellskål <edward.fjellskaal@gmail.com>
[*] Using libpcap version 1.8.1
[*] Using ldns version 1.7.0
[*] Reading from file ./failedudp-anon.pcap

1542877131.333128||0.0.0.3||127.0.0.1||IN||google.com.||A||172.217.23.206||189||1

-- Total DNS records allocated            :           1
-- Total DNS assets allocated             :           1
-- Total DNS packets over IPv4/TCP        :           0
-- Total DNS packets over IPv6/TCP        :           0
-- Total DNS packets over TCP decoded     :           0
-- Total DNS packets over TCP failed      :           0
-- Total DNS packets over IPv4/UDP        :          81
-- Total DNS packets over IPv6/UDP        :           0
-- Total DNS packets over UDP decoded     :           1
-- Total DNS packets over UDP failed      :          80
-- Total packets received from libpcap    :         130
-- Total Ethernet packets received        :           0
-- Total VLAN packets received            :           0

[*] passivedns ended.

Any idea why the packets are failing?

robcza commented 5 years ago

We have found the reason, the whole packet is shifted by VLAN and it does not match the passivedns packet structure, though it is a valid UDP packet. Not sure how to fix it though.