TCPDump DNS – Understanding Output Codes

domain-name-systemtcpdump

Captured on the nameserver:

21:54:35.391126 IP resolver.7538 > server.domain: 57385% [1au] A? www.domain.de. (42)

What das the percent sign in 57385% mean? As far as I can see 57385 is the clients sequence number, a plus would mean RD bit set.

Second question: what does the ARCOUNT do in the query? As I understand the tcpdump man page the [1au] means tcpdump treats this as a protocol anomalie – as would I. I see this in a lot of queries.

Best Answer

Read the source Luke :)

From tcpdump/print-domain.c:

printf("%d%s%s%s", EXTRACT_16BITS(&np->id), ns_ops[DNS_OPCODE(np)],
    DNS_RD(np) ? "+" : "",
    DNS_CD(np) ? "%" : "");

So % indicates "checking disabled" which to my understanding of RFC4035 indicates that the resolver is not enforcing authentication of the RRs on the server.

From bind/lib/bind/resolv/res_mkquery.c:

int
res_nopt(res_state statp,
     int n0,                /*%< current offset in buffer */
     u_char *buf,           /*%< buffer to put query */
     int buflen,            /*%< size of buffer */
     int anslen)            /*%< UDP answer buffer size */
{
[...]
hp->arcount = htons(ntohs(hp->arcount) + 1);

According to RFC2671 it's perfectly legal for a resolver to include additional data, and with this raise the UDP packet size above the 512 byte limit. So Ladadadada's assumption is correct in this aspect.

Thanks for your time and sorry that I didn't read the source before...

Related Topic