Tcpdump DNS Package (Linux High performance programming reading Note 2)

Tcpdump-i eth0-nt-s Port Domain

Host-t A www.baidu.com

Www.baidu.com is a alias for www.a.shifen.com.
Www.a.shifen.com has address 119.75.217.109
Www.a.shifen.com has address 119.75.218.70

IP 192.168.5.115.47195 > 192.168.5.1.domain:16925+ A? Www.baidu.com. (31)

0x0000:4500 003b cc76 0000 4011 2277 c0a8 0573 E ...; [Email protected] "W...S
0x0010:c0a8 0501 d5ae 0035 0027 8452 5da4 0100 .... 5. '. R] ...
0x0020:0001 0000 0000 0000 0377 7777 0562 6169 ... www.bai
0x0030:6475 0363 6f6d 0000 0100 .....

IP 192.168.5.1.domain > 192.168.5.115.47195:16925 2/0/0 a 119.75.218.70, a 119.75.217.109 (63)

0x0000:4500 0120 24a0 0000 8011 8968 c0a8 0501 e...$......h ....
0x0010:c0a8 0573 0035 d5ae 010c c6c2 5da4 8180 ... s.5 ...] ...
0x0020:0001 0003 0005 0005 0377 7777 0562 6169 ... www.bai
0x0030:6475 0363 6f6d 0000 0100 01c0 0c00 0500 du.com .....
0x0040:0100 0001 6600 0f03 7777 7701 6106 7368 .... f...www.a.sh
0x0050:6966 656e c016 c02b 0001 0001 0000 003c ifen...+.......<
0x0060:0004 774b d96d c02b 0001 0001 0000 003c.. wk.m.+.......<
0x0070:0004 774b da46 c02f 0002 0001 0000 01d1. Wk.f./.....
0x0080:0006 036e 7333 c02f c02f 0002 0001 0000 ... ns3././...
0X0090:01D1 0006 036e 7334 c02f c02f 0002 0001 ..... ns4././....
0x00a0:0000 01d1 0006 036e 7335 c02f c02f 0002 ... ns5././.
0x00b0:0001 0000 01d1 0006 036e 7332 c02f c02f .... ns2././
0x00c0:0002 0001 0000 01d1 0006 036e 7331 c02f ..... ns1./
0x00d0:c078 0001 0001 0000 005a 0004 73EF d2b0. x ... Z.. S ...
0X00E0:C0AE 0001 0001 0000 005a 0004 3d87 a5e0 ... Z.. =...
0x00f0:c09c 0001 0001 0000 01da 0004 b495 85f1 ..... .....
0X0100:C08A 0001 0001 0000 0160 0004 774b de11 ...... Wk..
0x0110:c066 0001 0001 0000 0125 0004 3d87 a2d7. f.......%. =...

See, in fact, as we build a database, using opcode to distinguish between different actions

Tcpdump DNS Package (Linux High performance programming reading Note 2)