tshark实时抓包获取DNS请求信息

1. tshark的安装

CentOS6 YUM源内的wireshark安装后,不支持GeoIP,需要自己编译一下最新的版本。


yum install  GeoIP GeoIP-devel geoipupdate -y
./configure  --with-geoip=/usr/share/GeoIP/ --enable-tshark=yes
make rpm-package

wireshark自身Makefile带了各发型版的打包功能,所以直接make rpm-package就能make出rpm包

2. 使用范例

  1. 抓取DNS请求

sudo /usr/local/bin/tshark   -i eth0  -o "ip.use_geoip:TRUE" -Y "udp.dstport == 53" -T fields -E separator='|' -e ip.src -e ip.geoip.src_country -e ip.geoip.src_asnum -e dns.flags -e dns.id -e dns.qry.name -e dns.qry.type -e  dns.count.answers  -e dns.count.answers -e dns.flags.rcode  -e  ip.len

抓到的内容如下:


211.138.19.28|China,China|AS24445 Henan Mobile Communications Co.,Ltd,AS24445 Henan Mobile Communications Co.,Ltd|0x00000010|0x0000355f|fxxxx.com|28||0||82
221.204.186.218|China,China|AS4837 CNCGROUP China169 Backbone,AS4837 CNCGROUP China169 Backbone|0x00000000|0x00004111|xxxx.com|1||0||75
123.157.135.3|China,China|AS4837 CNCGROUP China169 Backbone,AS4837 CNCGROUP China169 Backbone|0x00000000|0x00001108|xxxx.com|1||0||85
58.30.131.56|China,China|AS9811 srit corp.,beijing.,AS9811 srit corp.,beijing.|0x00000000|0x00005901|xxxxx.com|28||0||82
101.226.66.17|China,China|AS4812 China Telecom (Group),AS4812 China Telecom (Group)|0x00000010|0x00008d2a|xxxx.com|1||0||92
60.31.184.168|China,China|AS4837 CNCGROUP China169 Backbone,AS4837 CNCGROUP China169 Backbone|0x00000000|0x00005b22|xxxxx.com|1||0||79
60.31.184.168|China,China|AS4837 CNCGROUP China169 Backbone,AS4837 CNCGROUP China169 Backbone|0x00000000|0x0000da7e|lxxxx.com|1||0||74
74.125.176.202|United States,United States|AS15169 Google Inc.,AS15169 Google Inc.|0x00000000|0x0000ca93|xxxx.com|1||0||79
  1. 抓取响应内容

sudo /usr/local/bin/tshark   -i eth0  -o "ip.use_geoip:TRUE" -Y "udp.srcport == 53" -T fields -E separator='|' -e ip.src -e ip.geoip.src_country -e ip.geoip.src_asnum -e dns.flags -e dns.id -e dns.qry.name -e dns.qry.type -e  dns.count.answers  -e dns.count.answers -e dns.flags.rcode  -e  ip.len

3. 参考文档

  1. 支持的DNS字段 https://www.wireshark.org/docs/dfref/d/dns.html
此条目发表在dns分类目录。将固定链接加入收藏夹。

发表评论