Python/Scapy DNS sniffers和解析器

Question

我有一个用Python和Scapy写的DNS嗅探器。我可以捕捉到DNS消息，并获取IP地址、UDP源和目标的IP地址以及端口，但我在解析DNS部分时遇到了问题。希望能得到一些帮助或解决方案来解决这个问题。

#!/usr/bin/env python

from scapy.all import *
from datetime import datetime
import time
import datetime
import sys

############# MODIFY THIS PART IF NECESSARY ###############
interface = 'eth0'
filter_bpf = 'udp and port 53'

# ------ SELECT/FILTER MSGS
def select_DNS(pkt):
    pkt_time = pkt.sprintf('%sent.time%')
# ------ SELECT/FILTER DNS MSGS
    try:
        if DNSQR in pkt and pkt.dport == 53:
        # queries
           print '[**] Detected DNS QR Message at: ' + pkt_time
           # 
        elif DNSRR in pkt and pkt.sport == 53:
        # responses
           print '[**] Detected DNS RR Message at: ' + pkt_time
 # 
    except:
        pass
# ------ START SNIFFER 
sniff(iface=interface, filter=filter_bpf, store=0,  prn=select_DNS)

Answer 1

我最近写了一个工具，我想你指的是类似这样的东西：

from scapy.all import *
from datetime import datetime
import time

interface = 'eth0'
filter_bpf = 'udp and port 53'

def process_dns(pkt):
    if DNSQR in pkt and pkt.dport == 53:
        print('[**] Detected DNS Query at: ' + str(datetime.datetime.now()))
        print('Source IP: ' + pkt[IP].src)
        print('Destination IP: ' + pkt[IP].dst)
        print('Source Port: ' + str(pkt[UDP].sport))
        print('Destination Port: ' + str(pkt[UDP].dport))
        print('Query Name: ' + pkt[DNSQR].qname.decode('utf-8'))
        print('Query Type: ' + str(pkt[DNSQR].qtype))
    elif DNSRR in pkt and pkt.sport == 53:
        print('[**] Detected DNS Response at: ' + str(datetime.datetime.now()))
        print('Source IP: ' + pkt[IP].src)
        print('Destination IP: ' + pkt[IP].dst)
        print('Source Port: ' + str(pkt[UDP].sport))
        print('Destination Port: ' + str(pkt[UDP].dport))
        print('Response Name: ' + pkt[DNSRR].rrname.decode('utf-8'))
        print('Response Type: ' + str(pkt[DNSRR].type))

sniff(iface=interface, filter=filter_bpf, store=0, prn=process_dns)

Answer 2

我在网上搜索 scapy 解析 DNS 查询 的时候找到了这里（我这次是在处理一个捕获的 pcap 文件）

这是我的解决方案：

#!/usr/bin/env python

from scapy.all import *
from scapy.layers.dns import DNSRR, DNS, DNSQR

pcap = '/path/.../to/.../pcap/.../.pcap'
pkts = rdpcap(pcap)

for p in pkts:
    if p.haslayer(DNS):   
        if p.qdcount > 0 and isinstance(p.qd, DNSQR):
            name = p.qd.qname
        elif p.ancount > 0 and isinstance(p.an, DNSRR):
            name = p.an.rdata
        else:
            continue

        print name

Answer 3

>>> ls(DNS)
id         : ShortField           = (0)
qr         : BitField             = (0)
opcode     : BitEnumField         = (0)
aa         : BitField             = (0)
tc         : BitField             = (0)
rd         : BitField             = (0)
ra         : BitField             = (0)
z          : BitField             = (0)
rcode      : BitEnumField         = (0)
qdcount    : DNSRRCountField      = (None)
ancount    : DNSRRCountField      = (None)
nscount    : DNSRRCountField      = (None)
arcount    : DNSRRCountField      = (None)
qd         : DNSQRField           = (None)
an         : DNSRRField           = (None)
ns         : DNSRRField           = (None)
ar         : DNSRRField           = (None)
>>> ls(DNSQR)
qname      : DNSStrField          = ('.')
qtype      : ShortEnumField       = (1)
qclass     : ShortEnumField       = (1)
>>> ls(DNSRR)
rrname     : DNSStrField          = ('.')
type       : ShortEnumField       = (1)
rclass     : ShortEnumField       = (1)
ttl        : IntField             = (0)
rdlen      : RDLenField           = (None)
rdata      : RDataField           = ('')
>>> 

如果上面提到的层定义和字段不够用，你可以选择自己定义一个层，然后用你自己定义的层来解码数据包，或者直接从原始数据中获取信息。至于时间戳，你可以用 pkt.time 来获取。