zmap / zdns

Fast DNS Lookup Library and CLI Tool
Apache License 2.0
891 stars 121 forks source link

Header flags in A lookups #354

Closed jaehyeonjay closed 6 months ago

jaehyeonjay commented 6 months ago

I noticed ZDNS does not provide header flags (QR, RD, RA, etc) that you would see if you ran dig.

dig A "google.com" @8.8.8.8: ; <<>> DiG 9.16.1-Ubuntu <<>> A google.com @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8082 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;google.com. IN A

;; ANSWER SECTION: google.com. 300 IN A 142.250.72.206

;; Query time: 16 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat Feb 17 22:32:52 UTC 2024 ;; MSG SIZE rcvd: 55

With ZDNS, echo "google.com" | ./zdns A --name-servers=8.8.8.8:

{ "data": {"additionals":[{"flags":"","type":"EDNS0","udpsize":512,"version":0}], "answers":[{"answer":"142.251.214.142","class":"IN","name":"google.com","ttl":102,"type":"A"}], "protocol":"udp", "resolver":"8.8.8.8:53"}, "name":"google.com", "status":"NOERROR", "timestamp":"2024-02-17T22:33:07Z" }

I expected the ZDNS A module to be similar to dig, and it would be useful to have the flags. If there’s a way to get the flags that I’m not aware of, please let me know

zakird commented 6 months ago

This hidden in the default output, but you can request it if you'd like:

❯ echo "google.com" | ./zdns A --name-servers=8.8.8.8 --result-verbosity=long | jq .
{
  "class": "IN",
  "data": {
    "additionals": [
      {
        "flags": "",
        "type": "EDNS0",
        "udpsize": 512,
        "version": 0
      }
    ],
    "answers": [
      {
        "answer": "142.250.189.206",
        "class": "IN",
        "name": "google.com",
        "ttl": 163,
        "type": "A"
      }
    ],
    "flags": {
      "authenticated": false,
      "authoritative": false,
      "checking_disabled": false,
      "error_code": 0,
      "opcode": 0,
      "recursion_available": true,
      "recursion_desired": true,
      "response": true,
      "truncated": false
    },
    "protocol": "udp",
    "resolver": "8.8.8.8:53"
  },
  "name": "google.com",
  "status": "NOERROR",
  "timestamp": "2024-02-17T14:49:42-08:00"
}