6

If I send a DNSQR for www.google.com using sr1 I get several DNSRR(s) in reply, such as (done using ans[DNSRR].show()): 

###[ DNS Resource Record ]###
   rrname= 'www.google.com.'
   type= A
   rclass= IN
   ttl= 294
   rdlen= 4
   rdata= '173.194.35.176'
###[ DNS Resource Record ]###
   rrname= 'www.google.com.'
   type= A
   rclass= IN
   ttl= 294
   rdlen= 4
   rdata= '173.194.35.178'
###[ DNS Resource Record ]###
   ....

Is there a neat way to iterate over those DNSRR(s)? As is I use regex and the following code:

def get_ip_addr(s):
    pattern = r'[0-9]+(?:\.[0-9]+){3}'
    match = re.search(pattern, s)
    if match:
        return match.group()
    return None    

def resolve_host(host, nserver):
    print "resolving host: " + host + " (using nserver: " + nserver + ")"
    dns_pkt = IP(dst=nserver)/UDP()/DNS(rd=1, qd=DNSQR(qname=host))
    ans = sr1(dns_pkt)
    if ans:
        print "IP(s) for %s:" % (host)
        dnsrr_strings = repr(ans[DNSRR]).split("|")
        for dnsrr in dnsrr_strings :
            ip_addr = get_ip_addr(dnsrr)
            if ip_addr:
                print " %s"  % ip_addr
    else:
        sys.stderr.write("unable to lookup " + host)
Mikulas Dite
  • 7,790
  • 9
  • 59
  • 99
gash
  • 61
  • 1
  • 1
  • 3

1 Answers1

3

If we send a dns request with scapy, we can get dns response as follow:

>>> dns.show()
###[ DNS ]###
id= 43223
qr= 1L
opcode= QUERY
aa= 0L
tc= 0L
rd= 1L
ra= 1L
z= 0L
rcode= ok
qdcount= 1
ancount= 3
nscount= 0
arcount= 0
\qd\
 |###[ DNS Question Record ]###
 |  qname= 'search.yahoo.com.'
 |  qtype= A
 |  qclass= IN
\an\
 |###[ DNS Resource Record ]###
 |  rrname= 'search.yahoo.com.'
 |  type= CNAME
 |  rclass= IN
 |  ttl= 5
 |  rdlen= 39
 |  rdata= 'ds-global.l7.search.ystg1.b.yahoo.com.'
 |###[ DNS Resource Record ]###
 |  rrname= 'ds-global.l7.search.ystg1.b.yahoo.com.'
 |  type= CNAME
 |  rclass= IN
 |  ttl= 96
 |  rdlen= 43
 |  rdata= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
 |###[ DNS Resource Record ]###
 |  rrname= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
 |  type= A
 |  rclass= IN
 |  ttl= 94
 |  rdlen= 4
 |  rdata= '188.125.66.104'
ns= None
ar= None

qdcount - query dns count,
ancount - dns answer count,

dns.an[0] is the 1st DNSRR,
dns.an[1] is the 2nd DNSRR,
...

we can parse DNSRR with ancount, here is my demo code:

#!/usr/bin/env python
# -*- coding: utf8 -*-

from scapy.all import *


# disable verbose mode
conf.verb = 0


def parse_dnspkt(pkt):
    """ parse dns request / response packet """
    if pkt and pkt.haslayer('UDP') and pkt.haslayer('DNS'):
        ip = pkt['IP']
        udp = pkt['UDP']
        dns = pkt['DNS']

        # dns query packet
        if int(udp.dport) == 53:
            qname = dns.qd.qname

            print "\n[*] request: %s:%d -> %s:%d : %s" % (
                ip.src, udp.sport,
                ip.dst, udp.dport,
                qname)

        # dns reply packet
        elif int(udp.sport) == 53:
            # dns DNSRR count (answer count)
            for i in range(dns.ancount):
                dnsrr = dns.an[i]
                print "[*] response: %s:%s <- %s:%d : %s - %s" % (
                    ip.dst, udp.dport,
                    ip.src, udp.sport,
                    dnsrr.rrname, dnsrr.rdata)


def sniffer():
    sniff(filter="udp port 53", prn=parse_dnspkt)


if __name__ == "__main__":
    sniffer()

Execute nslookup search.yahoo.com and nslookup stackoverflow.com in your shell.

root:scapy/ #  python scapy-dns_sniff.py
WARNING: No route found for IPv6 destination :: (no default route?)

[*] request: 192.168.1.108:59199 -> 192.168.1.1:53 : search.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : search.yahoo.com. - ds-global.l7.search.ystg1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-global.l7.search.ystg1.b.yahoo.com. - ds-any-global.l7.search.ysta1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-any-global.l7.search.ysta1.b.yahoo.com. - 188.125.66.104

[*] request: 192.168.1.108:55391 -> 192.168.1.1:53 : stackoverflow.com.
[*] response: 192.168.1.108:55391 <- 192.168.1.1:53 : stackoverflow.com. - 198.252.206.16
debug
  • 991
  • 10
  • 14