Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DNS - rdata field full payload not delivered #264

Open
collinsullivanhub opened this issue Feb 4, 2021 · 1 comment
Open

DNS - rdata field full payload not delivered #264

collinsullivanhub opened this issue Feb 4, 2021 · 1 comment

Comments

@collinsullivanhub
Copy link

Trying to parse DNS responses with Scapy (see function below). My issue is all of the answers in the rdata[] field are not showing. When I do a packet capture with Wireshark, I see multiple answers in the rdata[] field, there are usually two or three answers in a single response packet for those unfamiliar with DNS.

I am only returned with one of the answers (the first). I have tried using sr() instead of sr1() and have also tried adding multi=True as a parameter when sending the packet but neither of these work.

Any ideas? I think this may be a bug

def send_query_recursion(resolver, target):
dns_req = IP(dst=f'{resolver}')/UDP(dport=53)/DNS(qr=0, rd=1, qd=DNSQR(qname=f'{target}'))
answer = sr1(dns_req, verbose=1)
for received in answer:
if received.haslayer(DNS):
for x in received:
print(str(x[DNS].id))
print("rrname: " + str(x[DNSRR].rrname))
print("Type: " + str(x[DNSRR].type))
if str(x[DNSRR].rclass) == "1":
print("Class: " + str(x[DNSRR].rclass) + " IN")
print("TTL: " + str(x[DNSRR].ttl))
print("Resource Data Length: " + str(x[DNSRR].rdlen))
print("Resource Data: " + str(x[DNSRR].rdata[:-1]))

@collinsullivanhub
Copy link
Author

To be more clear, when using a tool like dig, the rdata field produces several NS and responses. I can link a pcap if it makes it easier.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant