NAME¶

drool - DNS Replay Tool

SYNOPSIS¶

drool respdiff [ options ] path name file name host port

DESCRIPTION¶

This tool is to be used in conjunction with the tool-chain respdiff by CZ.NIC (see https://gitlab.labs.nic.cz/knot/respdiff).

It will replay DNS queries found in the PCAP, but only if a correlating response is also found, against the target host and port. The query, original response and the received response is then stored into a LMDB database located at path. The name before the PCAP file and the name before the target host are stored in the meta table which should correspond with the configuration use for respdiff in order for it to be able to read the results correctly.

OPTIONS¶

These options are specific for the respdiff command, see drool(1) for generic options.

-D

Show DNS queries and responses as processing goes.

--no-tcp

Do not use TCP.

--no-udp

Do not use UDP.

-T --threads

Use threads.

--tcp-threads N

Set the number of TCP threads to use, default 2.

--udp-threads N

Set the number of UDP threads to use, default 4.

--timeout N.N

Set timeout for waiting on responses [seconds.nanoseconds], default 10.0.

--size BYTES

Set the size (in bytes, multiple of OS page size) of the LMDB database, default 10485760.

DATABASE SIZE¶

Note that you will need to set a database size that is large enough for all queries, all original responses, all received responses and all analysis done by respdiff tool-chain in order for a successful analysis to be done.

EXAMPLE¶

This example replays a PCAP file against localhost and then uses the respdiff tool-chain to analyze the results.

$ drool respdiff /lmdb/path pcap file.pcap target 127.0.0.1 53
$ msgdiff.py /lmdb/path
$ diffsum.py /lmdb/path

SEE ALSO¶

drool(1)

AUTHORS¶

Jerry Lundström, DNS-OARC

Maintained by DNS-OARC

BUGS¶

For issues and feature requests please use:

For question and help please use: