From 513a07abc0a06eea6bea417e20b3d4bc3a0d546f Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Thu, 4 Mar 2021 19:39:15 +0100 Subject: Adding upstream version 2.4.2+debian. Signed-off-by: Daniel Baumann --- contrib/queryparse/INSTALL | 48 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 contrib/queryparse/INSTALL (limited to 'contrib/queryparse/INSTALL') diff --git a/contrib/queryparse/INSTALL b/contrib/queryparse/INSTALL new file mode 100644 index 0000000..c22d5b3 --- /dev/null +++ b/contrib/queryparse/INSTALL @@ -0,0 +1,48 @@ + +Installation +------------ + +Queryparse requires the dnspython and pcapy python modules. Pcapy depends +upon the pcap library. + +Libpcap may be obtained from http://www.tcpdump.org/ +Dnspython may be obtained from http://www.dnspython.org/ +Pcapy may be obtained from http://oss.coresecurity.com/projects/pcapy.html + +Ensure queryparse is somewhere in your path. + + +Usage +----- +queryparse -i -o + + -i : the tcpdump file that will be parsed to locate DNS + queries. + + -o : the file to which you wish to save the queries parsed + from . When complete, this file is suitable + for use as input to dnsperf. + + -r Keep packets whose RD flag is not set. + Use this flag when parsing captures from authoritative + servers. When parsing captures from caching servers, + do not use this flag unless you also want to parse the + queries the server itself is sending. + + -R Parse response packets (QR=1), instead of query packets + (QR=0). + + +Queryparse takes as input a packet capture file as created by tcpdump (or any +other program that can save data in pcap format). It parses every UDP packet, +looking for DNS queries. When it finds a potential query, it makes every +effort to parse it as a valid query. + +Once queryparse has finished, it will print a set of statistics regarding +the capture file to STDOUT. + + +NOTE: Currently, queryparse will correctly handle packets contained in either +Ethernet frames or Cisco HDLC frames. It is not guaranteed to work with other +framing formats. + -- cgit v1.2.3