/*
* Values for EDNS option types
*/
+#define E_LLQ 1 /* long lived queries protocol */
+#define E_UL 2 /* dynamic dns update leases */
+#define E_NSID 3 /* name server identifier */
+#define E_DAU 5 /* signal DNSSEC algorithm understood */
+#define E_DHU 6 /* signal DS hash understood */
+#define E_N3U 7 /* signal NSEC3 hash understood */
+#define E_ECS 8 /* EDNS client subnet */
+#define E_EXPIRE 9 /* zone expiration */
+#define E_COOKIE 10 /* DNS cookies */
+#define E_KEEPALIVE 11 /* TCP keepalive */
+#define E_PADDING 12 /* pad DNS messages */
+#define E_CHAIN 13 /* chain DNS queries */
+#define E_KEYTAG 14 /* EDNS key tag */
+#define E_CLIENTTAG 16 /* EDNS client tag */
+#define E_SERVERTAG 17 /* EDNS server tag */
+
+/*
+ * Values for DNSSEC Algorithms
+ * https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml
+ */
+
+#define A_DELETE 0
+#define A_RSAMD5 1
+#define A_DH 2
+#define A_DSA 3
+#define A_RSASHA1 5
+#define A_DSA_NSEC3_SHA1 6
+#define A_RSASHA1_NSEC3_SHA1 7
+#define A_RSASHA256 8
+#define A_RSASHA512 10
+#define A_ECC_GOST 12
+#define A_ECDSAP256SHA256 13
+#define A_ECDSAP384SHA384 14
+#define A_ED25519 15
+#define A_ED448 16
+#define A_INDIRECT 252
+#define A_PRIVATEDNS 253
+#define A_PRIVATEOID 254
+
+/*
+ * Values for NSEC3 algorithms
+ * https://www.iana.org/assignments/dnssec-nsec3-parameters/dnssec-nsec3-parameters.xhtml
+ */
+#define NSEC_SHA1 1
+
+/*
+ * Values for delegation signer algorithms
+ * https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml
+ */
+#define DS_SHA1 1
+#define DS_SHA256 2
+#define DS_GOST 3
+#define DS_SHA384 4
-#define E_NSID 3 /* name server identifier */
-#define E_DAU 5 /* signal DNSSEC algorithm understood */
-#define E_DHU 6 /* signal DS hash understood */
-#define E_N3U 7 /* signal NSEC3 hash understood */
-#define E_ECS 8 /* EDNS client subnet */
-#define E_EXPIRE 9 /* zone expiration */
-#define E_COOKIE 10 /* DNS cookies */
-#define E_KEEPALIVE 11 /* TCP keepalive */
-#define E_PADDING 12 /* pad DNS messages */
-#define E_CHAIN 13 /* chain DNS queries */
-#define E_KEYTAG 14 /* EDNS key tag */
/*
* Status return codes for T_UNSPEC conversion routines
return (cp + i);
}
+static void
+print_eopt_ecs(netdissect_options *ndo, const u_char *cp,
+ u_int data_len)
+{
+ u_int family, addr_bits, src_len, scope_len;
+
+ u_char padded[32];
+ char addr[INET6_ADDRSTRLEN];
+
+ /* ecs option must at least contain family, src len, and scope len */
+ if (data_len < 4) {
+ nd_print_invalid(ndo);
+ return;
+ }
+
+ family = GET_BE_U_2(cp);
+ cp += 2;
+ src_len = GET_U_1(cp);
+ cp += 1;
+ scope_len = GET_U_1(cp);
+ cp += 1;
+
+ if (family == 1)
+ addr_bits = 32;
+ else if (family == 2)
+ addr_bits = 128;
+ else {
+ nd_print_invalid(ndo);
+ return;
+ }
+
+ if (data_len - 4 > (addr_bits / 8)) {
+ nd_print_invalid(ndo);
+ return;
+ }
+ /* checks for invalid ecs scope or source length */
+ if (src_len > addr_bits || scope_len > addr_bits || ((src_len + 7) / 8) != (data_len - 4)) {
+ nd_print_invalid(ndo);
+ return;
+ }
+
+ /* pad the truncated address from ecs with zeros */
+ memset(padded, 0, sizeof(padded));
+ memcpy(padded, cp, data_len - 4);
+
+
+ if (family == 1)
+ ND_PRINT("%s/%d/%d", addrtostr(padded, addr, INET_ADDRSTRLEN),
+ src_len, scope_len);
+ else
+ ND_PRINT("%s/%d/%d", addrtostr6(padded, addr, INET6_ADDRSTRLEN),
+ src_len, scope_len);
+
+}
+
extern const struct tok edns_opt2str[];
+extern const struct tok dau_alg2str[];
+extern const struct tok dhu_alg2str[];
+extern const struct tok n3u_alg2str[];
+
/* print an <EDNS-option> */
static const u_char *
eopt_print(netdissect_options *ndo,
const u_char *cp)
{
- u_int i;
+ u_int opt, data_len, i;
+
+ if (!ND_TTEST_2(cp))
+ return (NULL);
+ opt = GET_BE_U_2(cp);
+ cp += 2;
+ ND_PRINT("%s", tok2str(edns_opt2str, "Opt%u", opt));
+ if (!ND_TTEST_2(cp))
+ return (NULL);
+ data_len = GET_BE_U_2(cp);
+ cp += 2;
+
+ ND_TCHECK_LEN(cp, data_len);
+
+ if (data_len > 0) {
+ ND_PRINT(" ");
+ switch (opt) {
+
+ case E_ECS:
+ print_eopt_ecs(ndo, cp, data_len);
+ break;
+ case E_COOKIE:
+ if (data_len < 8 || (data_len > 8 && data_len < 16) || data_len > 40)
+ nd_print_invalid(ndo);
+ else {
+ for (i = 0; i < data_len; ++i) {
+ /* split client and server cookie */
+ if (i == 8)
+ ND_PRINT(" ");
+ ND_PRINT("%02x", GET_U_1(cp + i));
+ }
+ }
+ break;
+ case E_KEEPALIVE:
+ if (data_len != 2)
+ nd_print_invalid(ndo);
+ else
+ /* keepalive is in increments of 100ms. Convert to seconds */
+ ND_PRINT("%0.1f sec", (GET_BE_U_2(cp) / 10.0));
+ break;
+ case E_EXPIRE:
+ if (data_len != 4)
+ nd_print_invalid(ndo);
+ else
+ ND_PRINT("%u sec", GET_BE_U_4(cp));
+ break;
+ case E_PADDING:
+ /* ignore contents and just print length */
+ ND_PRINT("(%u)", data_len);
+ break;
+ case E_KEYTAG:
+ if (data_len % 2 != 0)
+ nd_print_invalid(ndo);
+ else
+ for (i = 0; i < data_len; i += 2) {
+ if (i > 0)
+ ND_PRINT(" ");
+ ND_PRINT("%u", GET_BE_U_2(cp + i));
+ }
+ break;
+ case E_DAU:
+ for (i = 0; i < data_len; ++i) {
+ if (i > 0)
+ ND_PRINT(" ");
+ ND_PRINT("%s", tok2str(dau_alg2str, "Alg_%u", GET_U_1(cp + i)));
+ }
+ break;
+ case E_DHU:
+ for (i = 0; i < data_len; ++i) {
+ if (i > 0)
+ ND_PRINT(" ");
+ ND_PRINT("%s", tok2str(dhu_alg2str, "Alg_%u", GET_U_1(cp + i)));
+ }
+ break;
+ case E_N3U:
+ for (i = 0; i < data_len; ++i) {
+ if (i > 0)
+ ND_PRINT(" ");
+ ND_PRINT("%s", tok2str(n3u_alg2str, "Alg_%u", GET_U_1(cp + i)));
+ }
+ break;
+ case E_CHAIN:
+ fqdn_print(ndo, cp, cp + data_len);
+ break;
+ case E_NSID:
+ /* intentional fall-through. NSID is an undefined byte string */
+ default:
+ for (i = 0; i < data_len; ++i)
+ ND_PRINT("%02x", GET_U_1(cp + i));
+ break;
+ }
+ }
+ return (cp + data_len);
+
+ trunc:
+ nd_print_invalid(ndo);
+ return (NULL);
- if (!ND_TTEST_2(cp))
- return (NULL);
- i = GET_BE_U_2(cp);
- cp += 2;
- ND_PRINT(" %s", tok2str(edns_opt2str, "Opt%u", i));
- if (!ND_TTEST_2(cp))
- return (NULL);
- i = GET_BE_U_2(cp);
- cp += 2;
- return (cp + i);
}
+
+
extern const struct tok ns_type2str[];
/* https://www.iana.org/assignments/dns-parameters */
{ 0, NULL }
};
-extern const struct tok edns_opt2str[];
-
const struct tok edns_opt2str[] = {
- { E_NSID, "NSID" },
- { E_DAU, "DAU" },
- { E_DHU, "DHU" },
- { E_N3U, "N3U" },
- { E_ECS, "ECS" },
- { E_EXPIRE, "EXPIRE" },
- { E_COOKIE, "COOKIE" },
- { E_KEEPALIVE, "KEEPALIVE" },
- { E_PADDING, "PADDING" },
- { E_CHAIN, "CHAIN" },
- { E_KEYTAG, "KEYTAG" },
- { 0, NULL }
+ { E_LLQ, "LLQ" },
+ { E_UL, "UL" },
+ { E_NSID, "NSID" },
+ { E_DAU, "DAU" },
+ { E_DHU, "DHU" },
+ { E_N3U, "N3U" },
+ { E_ECS, "ECS" },
+ { E_EXPIRE, "EXPIRE" },
+ { E_COOKIE, "COOKIE" },
+ { E_KEEPALIVE, "KEEPALIVE" },
+ { E_PADDING, "PADDING" },
+ { E_CHAIN, "CHAIN" },
+ { E_KEYTAG, "KEY-TAG" },
+ { E_CLIENTTAG, "CLIENT-TAG" },
+ { E_SERVERTAG, "SERVER-TAG" },
+ { 0, NULL }
+};
+
+const struct tok dau_alg2str[] = {
+ { A_DELETE, "DELETE" },
+ { A_RSAMD5, "RSAMD5" },
+ { A_DH, "DH" },
+ { A_DSA, "DS" },
+ { A_RSASHA1, "RSASHA1" },
+ { A_DSA_NSEC3_SHA1, "DSA-NSEC3-SHA1" },
+ { A_RSASHA1_NSEC3_SHA1, "RSASHA1-NSEC3-SHA1" },
+ { A_RSASHA256, "RSASHA256" },
+ { A_RSASHA512, "RSASHA512" },
+ { A_ECC_GOST, "ECC-GOST" },
+ { A_ECDSAP256SHA256, "ECDSAP256SHA256" },
+ { A_ECDSAP384SHA384, "ECDSAP384SHA384" },
+ { A_ED25519, "ED25519" },
+ { A_ED448, "ED448" },
+ { A_INDIRECT, "INDIRECT" },
+ { A_PRIVATEDNS, "PRIVATEDNS" },
+ { A_PRIVATEOID, "PRIVATEOID" },
+ { 0, NULL }
+};
+
+const struct tok dhu_alg2str[] = {
+ { DS_SHA1, "SHA-1" },
+ { DS_SHA256,"SHA-256" },
+ { DS_GOST, "GOST_R_34.11-94" },
+ { DS_SHA384,"SHA-384" },
+ { 0, NULL }
+};
+
+const struct tok n3u_alg2str[] = {
+ { NSEC_SHA1,"SHA-1" },
+ { 0, NULL }
};
/* print a query */
ND_PRINT(" UDPsize=%u", class);
if (opt_flags & 0x8000)
ND_PRINT(" DO");
- while (cp < rp) {
- cp = eopt_print(ndo, cp);
- if (cp == NULL)
- return(NULL);
- }
+ if (cp < rp) {
+ ND_PRINT(" [");
+ while (cp < rp) {
+ cp = eopt_print(ndo, cp);
+ if (cp == NULL)
+ return(NULL);
+ if (cp < rp)
+ ND_PRINT(",");
+ }
+ ND_PRINT("]");
+ }
break;
case T_UNSPECA: /* One long string */
someip2 someip2.pcap someip2.out
# EDNS Options
-edns-opts edns-opts.pcap edns-opts.out
-edns-opts-v edns-opts.pcap edns-opts-v.out -v
-edns-opts-vv edns-opts.pcap edns-opts-vv.out -vv
+edns-opts edns-opts.pcap edns-opts.out
+edns-opts-v edns-opts.pcap edns-opts-v.out -v
+edns-opts-vv edns-opts.pcap edns-opts-vv.out -vv
- 1 15:51:13.645135 IP6 (flowlabel 0x59ab7, hlim 64, next-header UDP (17) payload length: 48) ::1.39913 > ::1.53: [bad udp cksum 0x0043 -> 0xd3c1!] 45044+ [1au] A? example.com. (40)
- 2 15:51:13.645368 IP6 (flowlabel 0x407db, hlim 64, next-header UDP (17) payload length: 200) ::1.53 > ::1.39913: [bad udp cksum 0x00db -> 0x47f8!] 45044 1/2/5 example.com. A 93.184.216.34 (192)
- 3 15:51:41.824299 IP6 (flowlabel 0x6cf0a, hlim 64, next-header UDP (17) payload length: 60) ::1.40241 > ::1.53: [bad udp cksum 0x004f -> 0x8d32!] 25196+ [1au] A? example.com. (52)
- 4 15:51:41.824510 IP6 (flowlabel 0x35b0b, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.40241: [bad udp cksum 0x00f7 -> 0x7d0f!] 25196 1/2/5 example.com. A 93.184.216.34 (220)
- 5 15:51:58.952626 IP6 (flowlabel 0xf9ade, hlim 64, next-header UDP (17) payload length: 64) ::1.52325 > ::1.53: [bad udp cksum 0x0053 -> 0xfe45!] 1171+ [1au] A? example.com. (56)
- 6 15:51:58.952934 IP6 (flowlabel 0x3185a, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.52325: [bad udp cksum 0x00f7 -> 0x8e9d!] 1171 1/2/5 example.com. A 93.184.216.34 (220)
- 7 15:52:09.278001 IP6 (flowlabel 0xb5cae, hlim 64, next-header UDP (17) payload length: 75) ::1.45845 > ::1.53: [bad udp cksum 0x005e -> 0xcc5b!] 24578+ [1au] A? example.com. (67)
- 8 15:52:09.278215 IP6 (flowlabel 0x3e25d, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.45845: [bad udp cksum 0x0102 -> 0xb15e!] 24578 1/2/5 example.com. A 93.184.216.34 (231)
- 9 15:52:21.041837 IP6 (flowlabel 0xc2911, hlim 64, next-header UDP (17) payload length: 79) ::1.55361 > ::1.53: [bad udp cksum 0x0062 -> 0x13aa!] 11702+ [1au] A? example.com. (71)
- 10 15:52:21.042080 IP6 (flowlabel 0x5d5a9, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.55361: [bad udp cksum 0x0102 -> 0x966c!] 11702 1/2/5 example.com. A 93.184.216.34 (231)
+ 1 20:58:40.639715 IP (tos 0x0, ttl 64, id 42311, offset 0, flags [none], proto UDP (17), length 57)
+ 192.0.0.1.46225 > 192.0.0.2.53: 13784+ A? example.com. (29)
+ 2 20:58:40.661836 IP (tos 0x0, ttl 48, id 43077, offset 0, flags [none], proto UDP (17), length 73)
+ 192.0.0.2.53 > 192.0.0.1.46225: 13784*- 1/0/0 example.com. A 93.184.216.34 (45)
+ 3 20:58:41.671700 IP (tos 0x0, ttl 64, id 42441, offset 0, flags [none], proto UDP (17), length 68)
+ 192.0.0.1.46225 > 192.0.0.2.53: 47424+ [1au] A? example.com. (40)
+ 4 20:58:41.693577 IP (tos 0x0, ttl 48, id 64719, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 47424*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 5 20:58:42.703534 IP (tos 0x0, ttl 64, id 42575, offset 0, flags [none], proto UDP (17), length 79)
+ 192.0.0.1.46225 > 192.0.0.2.53: 41739+ [1au] A? example.com. (51)
+ 6 20:58:42.725559 IP (tos 0x0, ttl 48, id 21779, offset 0, flags [none], proto UDP (17), length 95)
+ 192.0.0.2.53 > 192.0.0.1.46225: 41739*- 1/0/1 example.com. A 93.184.216.34 (67)
+ 7 20:58:43.734693 IP (tos 0x0, ttl 64, id 42674, offset 0, flags [none], proto UDP (17), length 80)
+ 192.0.0.1.46225 > 192.0.0.2.53: 18065+ [1au] A? example.com. (52)
+ 8 20:58:43.756707 IP (tos 0x0, ttl 48, id 43697, offset 0, flags [none], proto UDP (17), length 96)
+ 192.0.0.2.53 > 192.0.0.1.46225: 18065*- 1/0/1 example.com. A 93.184.216.34 (68)
+ 9 20:58:44.766528 IP (tos 0x0, ttl 64, id 42890, offset 0, flags [none], proto UDP (17), length 89)
+ 192.0.0.1.46225 > 192.0.0.2.53: 34237+ [1au] A? example.com. (61)
+ 10 20:58:44.788502 IP (tos 0x0, ttl 48, id 65435, offset 0, flags [none], proto UDP (17), length 105)
+ 192.0.0.2.53 > 192.0.0.1.46225: 34237*- 1/0/1 example.com. A 93.184.216.34 (77)
+ 11 20:58:45.797638 IP (tos 0x0, ttl 64, id 43148, offset 0, flags [none], proto UDP (17), length 80)
+ 192.0.0.1.46225 > 192.0.0.2.53: 30225+ [1au] A? example.com. (52)
+ 12 20:58:45.819504 IP (tos 0x0, ttl 48, id 21512, offset 0, flags [none], proto UDP (17), length 112)
+ 192.0.0.2.53 > 192.0.0.1.46225: 30225*- 1/0/1 example.com. A 93.184.216.34 (84)
+ 13 20:58:46.829454 IP (tos 0x0, ttl 64, id 43211, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: 52688+ [1au] A? example.com. (46)
+ 14 20:58:46.851441 IP (tos 0x0, ttl 48, id 43346, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 52688*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 15 20:58:47.860858 IP (tos 0x0, ttl 64, id 43235, offset 0, flags [none], proto UDP (17), length 83)
+ 192.0.0.1.46225 > 192.0.0.2.53: 57808+ [1au] A? example.com. (55)
+ 16 20:58:47.882669 IP (tos 0x0, ttl 48, id 64510, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 57808*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 17 20:58:48.892587 IP (tos 0x0, ttl 64, id 43380, offset 0, flags [none], proto UDP (17), length 89)
+ 192.0.0.1.46225 > 192.0.0.2.53: 33054+ [1au] A? example.com. (61)
+ 18 20:58:48.914406 IP (tos 0x0, ttl 48, id 20611, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 33054*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 19 20:58:49.924625 IP (tos 0x0, ttl 64, id 43587, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: 14353+ [1au] A? example.com. (46)
+ 20 20:58:49.946523 IP (tos 0x0, ttl 48, id 42366, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 14353*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 21 20:58:50.956601 IP (tos 0x0, ttl 64, id 43603, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: 17010+ [1au] A? example.com. (46)
+ 22 20:58:50.978366 IP (tos 0x0, ttl 48, id 64034, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 17010*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 23 20:58:51.988387 IP (tos 0x0, ttl 64, id 43789, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: 3894+ [1au] A? example.com. (48)
+ 24 20:58:52.010258 IP (tos 0x0, ttl 48, id 20169, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 3894*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
+ 25 20:58:53.015716 IP (tos 0x0, ttl 64, id 43925, offset 0, flags [none], proto UDP (17), length 72)
+ 192.0.0.1.46225 > 192.0.0.2.53: 8476+ [1au] A? example.com. (44)
+ 26 20:58:53.037529 IP (tos 0x0, ttl 48, id 42142, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 8476*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 27 20:58:54.047412 IP (tos 0x0, ttl 64, id 44065, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: 3966+ [1au] A? example.com. (48)
+ 28 20:58:54.069358 IP (tos 0x0, ttl 48, id 64128, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 3966*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 29 20:58:55.078435 IP (tos 0x0, ttl 64, id 44256, offset 0, flags [none], proto UDP (17), length 72)
+ 192.0.0.1.46225 > 192.0.0.2.53: 26580+ [1au] A? example.com. (44)
+ 30 20:58:55.100224 IP (tos 0x0, ttl 48, id 18983, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 26580*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 31 20:58:56.110237 IP (tos 0x0, ttl 64, id 44374, offset 0, flags [none], proto UDP (17), length 82)
+ 192.0.0.1.46225 > 192.0.0.2.53: 2190+ [1au] A? example.com. (54)
+ 32 20:58:56.132070 IP (tos 0x0, ttl 48, id 39653, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 2190*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 33 20:58:57.142215 IP (tos 0x0, ttl 64, id 44395, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: 16386+ [1au] A? example.com. (48)
+ 34 20:58:57.164050 IP (tos 0x0, ttl 48, id 60845, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 16386*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 35 20:58:58.174193 IP (tos 0x0, ttl 64, id 44643, offset 0, flags [none], proto UDP (17), length 78)
+ 192.0.0.1.46225 > 192.0.0.2.53: 6373+ [1au] A? example.com. (50)
+ 36 20:58:58.195911 IP (tos 0x0, ttl 48, id 16078, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: 6373*- 1/0/1 example.com. A 93.184.216.34 (56)
+ 37 20:58:59.206181 IP (tos 0x0, ttl 64, id 44899, offset 0, flags [none], proto UDP (17), length 108)
+ 192.0.0.1.46225 > 192.0.0.2.53: 29267+ [1au] A? example.com. (80)
+ 38 20:58:59.228465 IP (tos 0x0, ttl 48, id 37094, offset 0, flags [none], proto UDP (17), length 112)
+ 192.0.0.2.53 > 192.0.0.1.46225: 29267*- 1/0/1 example.com. A 93.184.216.34 (84)
+ 39 20:59:00.238274 IP (tos 0x0, ttl 64, id 45092, offset 0, flags [none], proto UDP (17), length 90)
+ 192.0.0.1.46225 > 192.0.0.2.53: 59326+ [1au] A? example.com. (62)
+ 40 20:59:00.260209 IP (tos 0x0, ttl 48, id 58611, offset 0, flags [none], proto UDP (17), length 122)
+ 192.0.0.2.53 > 192.0.0.1.46225: 59326*- 1/0/1 example.com. A 93.184.216.34 (94)
+ 41 20:59:01.269390 IP (tos 0x0, ttl 64, id 45316, offset 0, flags [none], proto UDP (17), length 100)
+ 192.0.0.1.46225 > 192.0.0.2.53: 17122+ [1au] A? example.com. (72)
+ 42 20:59:01.291167 IP (tos 0x0, ttl 48, id 14192, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: 17122*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227)
- 1 15:51:13.645135 IP6 (flowlabel 0x59ab7, hlim 64, next-header UDP (17) payload length: 48) ::1.39913 > ::1.53: [bad udp cksum 0x0043 -> 0xd3c1!] 45044+ [1au] A? example.com. ar: . OPT UDPsize=4096 (40)
- 2 15:51:13.645368 IP6 (flowlabel 0x407db, hlim 64, next-header UDP (17) payload length: 200) ::1.53 > ::1.39913: [bad udp cksum 0x00db -> 0x47f8!] 45044 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 (192)
- 3 15:51:41.824299 IP6 (flowlabel 0x6cf0a, hlim 64, next-header UDP (17) payload length: 60) ::1.40241 > ::1.53: [bad udp cksum 0x004f -> 0x8d32!] 25196+ [1au] A? example.com. ar: . OPT UDPsize=4096 COOKIE (52)
- 4 15:51:41.824510 IP6 (flowlabel 0x35b0b, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.40241: [bad udp cksum 0x00f7 -> 0x7d0f!] 25196 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE (220)
- 5 15:51:58.952626 IP6 (flowlabel 0xf9ade, hlim 64, next-header UDP (17) payload length: 64) ::1.52325 > ::1.53: [bad udp cksum 0x0053 -> 0xfe45!] 1171+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID COOKIE (56)
- 6 15:51:58.952934 IP6 (flowlabel 0x3185a, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.52325: [bad udp cksum 0x00f7 -> 0x8e9d!] 1171 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS b.iana-servers.net., example.com. NS a.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE (220)
- 7 15:52:09.278001 IP6 (flowlabel 0xb5cae, hlim 64, next-header UDP (17) payload length: 75) ::1.45845 > ::1.53: [bad udp cksum 0x005e -> 0xcc5b!] 24578+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID ECS COOKIE (67)
- 8 15:52:09.278215 IP6 (flowlabel 0x3e25d, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.45845: [bad udp cksum 0x0102 -> 0xb15e!] 24578 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE ECS (231)
- 9 15:52:21.041837 IP6 (flowlabel 0xc2911, hlim 64, next-header UDP (17) payload length: 79) ::1.55361 > ::1.53: [bad udp cksum 0x0062 -> 0x13aa!] 11702+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID ECS COOKIE Opt16 (71)
- 10 15:52:21.042080 IP6 (flowlabel 0x5d5a9, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.55361: [bad udp cksum 0x0102 -> 0x966c!] 11702 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE ECS (231)
+ 1 20:58:40.639715 IP (tos 0x0, ttl 64, id 42311, offset 0, flags [none], proto UDP (17), length 57)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd13 -> 0xc573!] 13784+ A? example.com. (29)
+ 2 20:58:40.661836 IP (tos 0x0, ttl 48, id 43077, offset 0, flags [none], proto UDP (17), length 73)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 13784*- q: A? example.com. 1/0/0 example.com. A 93.184.216.34 (45)
+ 3 20:58:41.671700 IP (tos 0x0, ttl 64, id 42441, offset 0, flags [none], proto UDP (17), length 68)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd1e -> 0x9191!] 47424+ [1au] A? example.com. ar: . OPT UDPsize=12345 DO (40)
+ 4 20:58:41.693577 IP (tos 0x0, ttl 48, id 64719, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 47424*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 5 20:58:42.703534 IP (tos 0x0, ttl 64, id 42575, offset 0, flags [none], proto UDP (17), length 79)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd29 -> 0x6dce!] 41739+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.0.2.0/24/0] (51)
+ 6 20:58:42.725559 IP (tos 0x0, ttl 48, id 21779, offset 0, flags [none], proto UDP (17), length 95)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 41739*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 192.0.2.0/24/0] (67)
+ 7 20:58:43.734693 IP (tos 0x0, ttl 64, id 42674, offset 0, flags [none], proto UDP (17), length 80)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2a -> 0xc240!] 18065+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.1.2.3/32/0] (52)
+ 8 20:58:43.756707 IP (tos 0x0, ttl 48, id 43697, offset 0, flags [none], proto UDP (17), length 96)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 18065*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 192.1.2.3/32/0] (68)
+ 9 20:58:44.766528 IP (tos 0x0, ttl 64, id 42890, offset 0, flags [none], proto UDP (17), length 89)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd33 -> 0xc368!] 34237+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 2001:db8:85a3::8a2e:0:0/100/0] (61)
+ 10 20:58:44.788502 IP (tos 0x0, ttl 48, id 65435, offset 0, flags [none], proto UDP (17), length 105)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 34237*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 2001:db8:85a3::8a2e:0:0/100/0] (77)
+ 11 20:58:45.797638 IP (tos 0x0, ttl 64, id 43148, offset 0, flags [none], proto UDP (17), length 80)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2a -> 0x750a!] 30225+ [1au] A? example.com. ar: . OPT UDPsize=4096 [COOKIE a954d29208767b5c] (52)
+ 12 20:58:45.819504 IP (tos 0x0, ttl 48, id 21512, offset 0, flags [none], proto UDP (17), length 112)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 30225*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE a954d29208767b5c cf75f75b5db0bf0575c9f2d76c962883] (84)
+ 13 20:58:46.829454 IP (tos 0x0, ttl 64, id 43211, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0x971a!] 52688+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [DAU DSA-NSEC3-SHA1 RSASHA1-NSEC3-SHA1] (46)
+ 14 20:58:46.851441 IP (tos 0x0, ttl 48, id 43346, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 52688*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 15 20:58:47.860858 IP (tos 0x0, ttl 64, id 43235, offset 0, flags [none], proto UDP (17), length 83)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2d -> 0x83fc!] 57808+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [DAU PRIVATEDNS,DHU SHA-256,N3U SHA-1] (55)
+ 16 20:58:47.882669 IP (tos 0x0, ttl 48, id 64510, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 57808*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 17 20:58:48.892587 IP (tos 0x0, ttl 64, id 43380, offset 0, flags [none], proto UDP (17), length 89)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd33 -> 0xaa4d!] 33054+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [CHAIN foo.example.com.] (61)
+ 18 20:58:48.914406 IP (tos 0x0, ttl 48, id 20611, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 33054*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 19 20:58:49.924625 IP (tos 0x0, ttl 64, id 43587, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0xae09!] 14353+ [1au] A? example.com. ar: . OPT UDPsize=4096 [KEEPALIVE 123.4 sec] (46)
+ 20 20:58:49.946523 IP (tos 0x0, ttl 48, id 42366, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 14353*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 21 20:58:50.956601 IP (tos 0x0, ttl 64, id 43603, offset 0, flags [none], proto UDP (17), length 74)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0x8c36!] 17010+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [KEY-TAG 40000] (46)
+ 22 20:58:50.978366 IP (tos 0x0, ttl 48, id 64034, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 17010*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 23 20:58:51.988387 IP (tos 0x0, ttl 64, id 43789, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0xfc19!] 3894+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [KEY-TAG 30000 60000] (48)
+ 24 20:58:52.010258 IP (tos 0x0, ttl 48, id 20169, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 3894*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
+ 25 20:58:53.015716 IP (tos 0x0, ttl 64, id 43925, offset 0, flags [none], proto UDP (17), length 72)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd22 -> 0xc9da!] 8476+ [1au] A? example.com. ar: . OPT UDPsize=4096 [EXPIRE] (44)
+ 26 20:58:53.037529 IP (tos 0x0, ttl 48, id 42142, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 8476*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 27 20:58:54.047412 IP (tos 0x0, ttl 64, id 44065, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0x6656!] 3966+ [1au] A? example.com. ar: . OPT UDPsize=4096 [EXPIRE 1209600 sec] (48)
+ 28 20:58:54.069358 IP (tos 0x0, ttl 48, id 64128, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 3966*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 29 20:58:55.078435 IP (tos 0x0, ttl 64, id 44256, offset 0, flags [none], proto UDP (17), length 72)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd22 -> 0x8328!] 26580+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID] (44)
+ 30 20:58:55.100224 IP (tos 0x0, ttl 48, id 18983, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 26580*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 31 20:58:56.110237 IP (tos 0x0, ttl 64, id 44374, offset 0, flags [none], proto UDP (17), length 82)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2c -> 0x8c9c!] 2190+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID 00112233445566778899] (54)
+ 32 20:58:56.132070 IP (tos 0x0, ttl 48, id 39653, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 2190*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 33 20:58:57.142215 IP (tos 0x0, ttl 64, id 44395, offset 0, flags [none], proto UDP (17), length 76)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0x0d03!] 16386+ [1au] A? example.com. ar: . OPT UDPsize=4096 [Opt77 deadbeef] (48)
+ 34 20:58:57.164050 IP (tos 0x0, ttl 48, id 60845, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 16386*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 35 20:58:58.174193 IP (tos 0x0, ttl 64, id 44643, offset 0, flags [none], proto UDP (17), length 78)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd28 -> 0xd1f6!] 6373+ [1au] A? example.com. ar: . OPT UDPsize=4096 [PADDING (6)] (50)
+ 36 20:58:58.195911 IP (tos 0x0, ttl 48, id 16078, offset 0, flags [none], proto UDP (17), length 84)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 6373*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56)
+ 37 20:58:59.206181 IP (tos 0x0, ttl 64, id 44899, offset 0, flags [none], proto UDP (17), length 108)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd46 -> 0x2f3b!] 29267+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID 0123456789abcdef,PADDING (12),COOKIE aaaaaaaaaaaaaaaa] (80)
+ 38 20:58:59.228465 IP (tos 0x0, ttl 48, id 37094, offset 0, flags [none], proto UDP (17), length 112)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 29267*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE aaaaaaaaaaaaaaaa b5a8ca325db0bf132274faa81cef9aa4] (84)
+ 39 20:59:00.238274 IP (tos 0x0, ttl 64, id 45092, offset 0, flags [none], proto UDP (17), length 90)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd34 -> 0x883d!] 59326+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.1.0.0/16/0,COOKIE aaaaaaaaaaaaaaaa] (62)
+ 40 20:59:00.260209 IP (tos 0x0, ttl 48, id 58611, offset 0, flags [none], proto UDP (17), length 122)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 59326*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE aaaaaaaaaaaaaaaa 70a50ca25db0bf14d523a3f77957f788,ECS 192.1.0.0/16/0] (94)
+ 41 20:59:01.269390 IP (tos 0x0, ttl 64, id 45316, offset 0, flags [none], proto UDP (17), length 100)
+ 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd3e -> 0x4731!] 17122+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [CHAIN com.,DHU GOST_R_34.11-94,PADDING (4),NSID aabbccddeeff] (72)
+ 42 20:59:01.291167 IP (tos 0x0, ttl 48, id 14192, offset 0, flags [none], proto UDP (17), length 255)
+ 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 17122*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227)
- 1 15:51:13.645135 IP6 ::1.39913 > ::1.53: 45044+ [1au] A? example.com. (40)
- 2 15:51:13.645368 IP6 ::1.53 > ::1.39913: 45044 1/2/5 A 93.184.216.34 (192)
- 3 15:51:41.824299 IP6 ::1.40241 > ::1.53: 25196+ [1au] A? example.com. (52)
- 4 15:51:41.824510 IP6 ::1.53 > ::1.40241: 25196 1/2/5 A 93.184.216.34 (220)
- 5 15:51:58.952626 IP6 ::1.52325 > ::1.53: 1171+ [1au] A? example.com. (56)
- 6 15:51:58.952934 IP6 ::1.53 > ::1.52325: 1171 1/2/5 A 93.184.216.34 (220)
- 7 15:52:09.278001 IP6 ::1.45845 > ::1.53: 24578+ [1au] A? example.com. (67)
- 8 15:52:09.278215 IP6 ::1.53 > ::1.45845: 24578 1/2/5 A 93.184.216.34 (231)
- 9 15:52:21.041837 IP6 ::1.55361 > ::1.53: 11702+ [1au] A? example.com. (71)
- 10 15:52:21.042080 IP6 ::1.53 > ::1.55361: 11702 1/2/5 A 93.184.216.34 (231)
+ 1 20:58:40.639715 IP 192.0.0.1.46225 > 192.0.0.2.53: 13784+ A? example.com. (29)
+ 2 20:58:40.661836 IP 192.0.0.2.53 > 192.0.0.1.46225: 13784*- 1/0/0 A 93.184.216.34 (45)
+ 3 20:58:41.671700 IP 192.0.0.1.46225 > 192.0.0.2.53: 47424+ [1au] A? example.com. (40)
+ 4 20:58:41.693577 IP 192.0.0.2.53 > 192.0.0.1.46225: 47424*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 5 20:58:42.703534 IP 192.0.0.1.46225 > 192.0.0.2.53: 41739+ [1au] A? example.com. (51)
+ 6 20:58:42.725559 IP 192.0.0.2.53 > 192.0.0.1.46225: 41739*- 1/0/1 A 93.184.216.34 (67)
+ 7 20:58:43.734693 IP 192.0.0.1.46225 > 192.0.0.2.53: 18065+ [1au] A? example.com. (52)
+ 8 20:58:43.756707 IP 192.0.0.2.53 > 192.0.0.1.46225: 18065*- 1/0/1 A 93.184.216.34 (68)
+ 9 20:58:44.766528 IP 192.0.0.1.46225 > 192.0.0.2.53: 34237+ [1au] A? example.com. (61)
+ 10 20:58:44.788502 IP 192.0.0.2.53 > 192.0.0.1.46225: 34237*- 1/0/1 A 93.184.216.34 (77)
+ 11 20:58:45.797638 IP 192.0.0.1.46225 > 192.0.0.2.53: 30225+ [1au] A? example.com. (52)
+ 12 20:58:45.819504 IP 192.0.0.2.53 > 192.0.0.1.46225: 30225*- 1/0/1 A 93.184.216.34 (84)
+ 13 20:58:46.829454 IP 192.0.0.1.46225 > 192.0.0.2.53: 52688+ [1au] A? example.com. (46)
+ 14 20:58:46.851441 IP 192.0.0.2.53 > 192.0.0.1.46225: 52688*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 15 20:58:47.860858 IP 192.0.0.1.46225 > 192.0.0.2.53: 57808+ [1au] A? example.com. (55)
+ 16 20:58:47.882669 IP 192.0.0.2.53 > 192.0.0.1.46225: 57808*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 17 20:58:48.892587 IP 192.0.0.1.46225 > 192.0.0.2.53: 33054+ [1au] A? example.com. (61)
+ 18 20:58:48.914406 IP 192.0.0.2.53 > 192.0.0.1.46225: 33054*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 19 20:58:49.924625 IP 192.0.0.1.46225 > 192.0.0.2.53: 14353+ [1au] A? example.com. (46)
+ 20 20:58:49.946523 IP 192.0.0.2.53 > 192.0.0.1.46225: 14353*- 1/0/1 A 93.184.216.34 (56)
+ 21 20:58:50.956601 IP 192.0.0.1.46225 > 192.0.0.2.53: 17010+ [1au] A? example.com. (46)
+ 22 20:58:50.978366 IP 192.0.0.2.53 > 192.0.0.1.46225: 17010*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 23 20:58:51.988387 IP 192.0.0.1.46225 > 192.0.0.2.53: 3894+ [1au] A? example.com. (48)
+ 24 20:58:52.010258 IP 192.0.0.2.53 > 192.0.0.1.46225: 3894*- 2/0/1 A 93.184.216.34, RRSIG (227)
+ 25 20:58:53.015716 IP 192.0.0.1.46225 > 192.0.0.2.53: 8476+ [1au] A? example.com. (44)
+ 26 20:58:53.037529 IP 192.0.0.2.53 > 192.0.0.1.46225: 8476*- 1/0/1 A 93.184.216.34 (56)
+ 27 20:58:54.047412 IP 192.0.0.1.46225 > 192.0.0.2.53: 3966+ [1au] A? example.com. (48)
+ 28 20:58:54.069358 IP 192.0.0.2.53 > 192.0.0.1.46225: 3966*- 1/0/1 A 93.184.216.34 (56)
+ 29 20:58:55.078435 IP 192.0.0.1.46225 > 192.0.0.2.53: 26580+ [1au] A? example.com. (44)
+ 30 20:58:55.100224 IP 192.0.0.2.53 > 192.0.0.1.46225: 26580*- 1/0/1 A 93.184.216.34 (56)
+ 31 20:58:56.110237 IP 192.0.0.1.46225 > 192.0.0.2.53: 2190+ [1au] A? example.com. (54)
+ 32 20:58:56.132070 IP 192.0.0.2.53 > 192.0.0.1.46225: 2190*- 1/0/1 A 93.184.216.34 (56)
+ 33 20:58:57.142215 IP 192.0.0.1.46225 > 192.0.0.2.53: 16386+ [1au] A? example.com. (48)
+ 34 20:58:57.164050 IP 192.0.0.2.53 > 192.0.0.1.46225: 16386*- 1/0/1 A 93.184.216.34 (56)
+ 35 20:58:58.174193 IP 192.0.0.1.46225 > 192.0.0.2.53: 6373+ [1au] A? example.com. (50)
+ 36 20:58:58.195911 IP 192.0.0.2.53 > 192.0.0.1.46225: 6373*- 1/0/1 A 93.184.216.34 (56)
+ 37 20:58:59.206181 IP 192.0.0.1.46225 > 192.0.0.2.53: 29267+ [1au] A? example.com. (80)
+ 38 20:58:59.228465 IP 192.0.0.2.53 > 192.0.0.1.46225: 29267*- 1/0/1 A 93.184.216.34 (84)
+ 39 20:59:00.238274 IP 192.0.0.1.46225 > 192.0.0.2.53: 59326+ [1au] A? example.com. (62)
+ 40 20:59:00.260209 IP 192.0.0.2.53 > 192.0.0.1.46225: 59326*- 1/0/1 A 93.184.216.34 (94)
+ 41 20:59:01.269390 IP 192.0.0.1.46225 > 192.0.0.2.53: 17122+ [1au] A? example.com. (72)
+ 42 20:59:01.291167 IP 192.0.0.2.53 > 192.0.0.1.46225: 17122*- 2/0/1 A 93.184.216.34, RRSIG (227)
projects / tcpdump / commitdiff
