search

gamelinux / passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup
http://gamelinux.org/
1.67k stars 372 forks source link

added extra RR types: LOC and various DNSSEC (DS, DNSKEY, RRSIG, NSEC… #55

Closed gavinspearhead closed 9 years ago

gavinspearhead commented 9 years ago

…, NSEC3, NSEC3param)

gamelinux commented 9 years ago

Do you have any pcaps of the traffic for these RR types you can share?

gavinspearhead commented 9 years ago

I don't have any ready-made pcaps. However, dig -t any tjeb.nl or dig -t any forfun.net have most of the records types that I added. NSEC3 isn't working cause it is (AFAIK) only used in the additional section if DNSSEC is enabled, and these and the authoristy section are not parsed. I haven't encountered NSEC3 yet as in an answer section.

My C skills are a bit rusty, so code may be a bit choppy.... :/

gavinspearhead commented 9 years ago

BTW I also wrote some php code to graph some stuff, based on the singular html index.php already included, I can add them to the repo if you like

gamelinux commented 9 years ago

yeah, push the changes to index.php :) I was able to test most of the dnssec stuff, except for the NSEC3. The other records I was not able to find any good candidates for testing :/

If you where to grab any pcaps one day of the records, plz send over, as its good to have for regression testing etc. later on.

gavinspearhead commented 9 years ago

dig -t loc forfun.net
dig -t gpos forfun.net dig -t spf tjeb.nl dig -t spf tjeb.nl dig -t hinfo testing123456.us.to (the last one is just a testing entry i made)

I'll add the webstuff...

gavinspearhead commented 9 years ago

added webstuff. Changed the database a bit too, .sql included. It's not documented at all. The basic options are in the header of the page, but there is more to be found in the code. I might just add all the options to the pages someday.... check_malware_domains.php is a commandline script to check for malware domains update_asn.sh is a script to fetch the ASNs for each IP address parse_tlds.php is a commandline script to load the list of top level domains (from a mozilla url) and store it in the db. It's used to generate the 2nd level domains list.

have fun.