dns.length field/filter shows nothing

asked 2020-02-02 21:37:51 +0000

kaos
13 ●1 ●5 ●6

according the display filter reference https://www.wireshark.org/docs/dfref/... the field dns.length is the "Length". I assume it's a length of DNS payload ( dns.length=udp.length - 20 (UDP header)). If I type "dns.length" (which means "dns.length is present") or "dns.length > 0" (which means dns.length is greater than 0) in the display filter field there are no matches. I If type "dns", wireshark shows all DNS packets. Other dns fields like "dns.resp.len" work as expected. Tested with both Wireshark versions 3.2.0 and 2.6.14

Comments

I've just consulted source code:

  if (transport == DNS_TRANSPORT_TCP) {
/* Put the length indication into the tree. */
proto_tree_add_item(dns_tree, hf_dns_length, tvb, offset - 2, 2, ENC_BIG_ENDIAN);

}

    { &hf_dns_length,
  { "Length", "dns.length",
    FT_UINT16, BASE_DEC, NULL, 0x0,
    "Length of DNS-over-TCP request or response", HFILL }},

it seems the dns.length field is present only in DNS-over-TCP request or response, why not in DNS-over-UDP?

kaos ( 2020-02-02 21:50:29 +0000 )edit

I workaround this limitation by calculating ip.len - 28 for DNS-over-UDP and ip.len - 40 for DNS-over-TCP

kaos ( 2020-02-03 00:11:55 +0000 )edit

add a comment

answered 2020-02-02 23:52:05 +0000

Chuckc
3023 ●6 ●611 ●20

https://tools.ietf.org/rfc/rfc1035.txt

4.2.1. UDP usage

Messages sent using UDP user server port 53 (decimal).

Messages carried by UDP are restricted to 512 bytes (not counting the IP
or UDP headers).  Longer messages are truncated and the TC bit is set in
the header.

4.2.2. TCP usage

Messages sent over TCP connections use server port 53 (decimal).  The
message is prefixed with a two byte length field which gives the message
length, excluding the two byte length field.  This length field allows
the low-level processing to assemble a complete message before beginning
to parse it.

edit flag offensive delete link

Comments

thank you for the clarification bubbasnmp! accepted as answer. Cannot upvote as I have not enough points :-(

kaos ( 2020-02-03 00:09:55 +0000 )edit

And this is because:

UDP is a protocol that offers, to protocols running on top of it (such as DNS), a "service" in which a "packet", with defined packet boundaries, can be sent, so a single DNS message can be sent in a single UDP message.

TCP, however, is a protocol that offers, to protocols running on top if it (such as DNS), a "service" in which you just send a stream of bytes, with no packet boundaries. This requires many protocols to impose their own packet boundaries; DNS does this by putting that additional length field at the beginning of each DNS packet, so that the receiver knows when that DNS packet ends, and the next DNS packet begins, in the byte stream.

Guy Harris ( 2020-02-03 01:27:03 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

dns.length field/filter shows nothing

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

dns.length field/filter shows nothing edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

dns.length field/filter shows nothing