[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Need help with reading tcpdump output for UDP Name Server Requests



I am using tcpdump to answer some questions about the operation of my LAN. 
At the moment, I would like to understand some lines that report name server 
requests. I have the following lines in one run:

14:27:31.878854 big.lan.gnu.32770 > cmn.lan.gnu.domain:  52213+ AAAA? cmn.lan.gnu. (29) (DF)
14:27:31.879894 cmn.lan.gnu.domain > big.lan.gnu.32770:  52213 ServFail 0/0/0 (29)
14:27:31.880309 big.lan.gnu.32770 > cmn.lan.gnu.domain:  52213+ AAAA? cmn.lan.gnu. (29) (DF)
14:27:31.880691 cmn.lan.gnu.domain > big.lan.gnu.32770:  52213 ServFail 0/0/0 (29)
14:27:31.880961 big.lan.gnu.32770 > cmn.lan.gnu.domain:  52214+ AAAA? cmn. (21) (DF)

And these lines in another

14:59:08.604194 big.lan.gnu.32770 > cmn.lan.gnu.domain:  13694+ A? www.nytimes.com. (33) (DF)
14:59:13.612287 big.lan.gnu.32770 > cmn.lan.gnu.domain:  13694+ A? www.nytimes.com. (33) (DF)
14:59:18.623348 big.lan.gnu.32770 > cmn.lan.gnu.domain:  13695+ A? www.nytimes.com.lan.gnu. (41) (DF)
14:59:18.623992 cmn.lan.gnu.domain > big.lan.gnu.32770:  13695 ServFail 0/0/0 (41)
14:59:18.625343 big.lan.gnu.32770 > cmn.lan.gnu.domain:  13695+ A? www.nytimes.com.lan.gnu. (41) (DF)
14:59:18.625785 cmn.lan.gnu.domain > big.lan.gnu.32770:  13695 ServFail 0/0/0 (41)
14:59:18.626772 big.lan.gnu.32770 > cmn.lan.gnu.domain:  36845+ A? www.nytimes.com. (33) (DF)

These lines appear to match to formats of Name Server Requests and Responses as described in the 
tcpdump man page, except that I do not see an explanation for ' AAAA?'. In the man page there is an
explanation for ' A?'; it indicates a query that requests an address record, but there is not an 
exhaustive list of query types. Is ' AAAA?' a different query type, or is the 'AAA' following the 
initial ' A' a query class code. I don't see either an 'AAAA' class or an 'AAA' type documented in 
RFC-1035.

Where else should I look? 
Or is the answer so simple and obvious that someone can give it to me from memory? 
Or is this OT for this list? 
To what list should I go with this question?

TIA


-- 
Paul E Condon           
pecondon@quiknet.com    



Reply to: