(das Syntax Highlighting Plugin für des Blog ist neu. Sollte es den Code irgendwie unbrauchbar machen, bitte kurze Meldung. Danke)
#!/usr/bin/python
from scapy.all import *
from time import time
from scapy.layers.dns import dnstypes
# REQ = request, ANS = answer, NX = not found
dnsdict= {}
def dnsin(x):
dnsdata=x.getlayer("DNS")
try:
dnsdata.an
except AttributeError:
return "ERROR no query data found in packet. Skipping..."
if (dnsdata.an == None):
if (dnsdata.ns == None):
print "REQ\t%i -> %s" % (dnsdata.id,dnsdata.qd.qname )
if (dnsdict.has_key(dnsdata.id)):
print "ERROR id %i is an orphan. Overwrting..." % dnsdata.id
dnsdict[dnsdata.id] = time()
else:
print "NX \t%i -> %s" % (dnsdata.id,dnsdata.qd.qname )
if (dnsdict.has_key(dnsdata.id)):
print "### NX %f seconds -> %s (%i/%s)" % (time()-dnsdict.pop(dnsdata.id), dnsdata.qd.qname,dnsdata.id, dnstypes[dnsdata.qd.qtype])
else:
print "ERROR request for id %i (%s) not found. Skipping..." % (dnsdata.id,dnsdata.qd.qname)
else:
print "ANS\t%i -> %s" % (dnsdata.id,dnsdata.qd.qname )
if (dnsdict.has_key(dnsdata.id)):
print "### ANS %f seconds -> %s (%i/%s)" % (time()-dnsdict.pop(dnsdata.id), dnsdata.qd.qname,dnsdata.id, dnstypes[dnsdata.qd.qtype])
else:
print "ERROR request for id %i (%s) not found. Skipping..." % (dnsdata.id,dnsdata.qd)
sniff(filter="port 53",prn=lambda x: dnsin(x),count=0)
Kommentare