How to list all the DNS domains?
I have a requirement: check my snapshot, in a duration there have several DNS queries, this link below is one: https://i.stack.imgur.com/za2FV.png
Queries: assets.msn.com: type A, class IN
how to get all the domains of all queries as a list?
This is a classic case for using tshark with the -T fields option. With a display filter set so that only answers are shown:
tshark -r <yourcapture> -Y "dns.count.answers > 0" -T fields -e dns.qry.name -e dns.resp.name
replacing <yourcapture> with the path to the capture file.
Output looks like this, with first the query, then the answer(s):
az667904.vo.msecnd.net az667904.vo.msecnd.net,az667904-pme.azureedge.net,az667904-pme.ec.azureedge.net,cs9.wpc.v0cdn.net
Note in this case there were multiple answer records for the query, all comma separated.
Asked: 2021-11-19 02:54:31 +0000
Seen: 2,106 times
Last updated: Nov 19 '21
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.