authority RRs tshark
how can i get the DNS authority RRs with tshark?
dns.ns is the closest thing to it, but probably won't give you authoritative answers only.
Asked: 2017-12-11 19:57:05 +0000
Seen: 932 times
Last updated: Dec 12 '17
What do you mean by "get"? If they're in the packet trace you've captured or are reading, they should show up in DNS packets containing them, just as other DNS RRs do.
I need to parse some pcap files to csv, so Im using the T fields and -E separator in tshark. But I cant find a field for the DNS RRs, despite it is in wireshark