You're getting wishy-washy answers because you've asked a wishy-washy question.
Can some one tell how to print a DNS packet answer
First of all, by what means are you capturing the DNS packet? Or put differently, what are you starting with?
the answer part it has the domain name compressed
The answer to most requests ("A") is an IPv4 address, not a domain name. It's not compressed. It's stored as a 32-bit int in network byte order.
When doing a reverse lookup ("PTR"), you get a domain name. It's not stored as a single string, but it's not compressed either. It's stored as a number of NUL-terminated strings, one for each segment of the full domain name, plus an empty one.
RFC 1035: Domain Names - Implementation and Specification
| [reply] |
tanx everbody, i make the situation clear,
I made a DNS packet and then sent it to the server, i got an answer, parsed the Header part then parsed the Question part
now i want to parse the Answer part, in the answer part has the format "NAME,TYPE,CLASS,TTL,RDLENGHT,RDATA", if this NAME is compressed how can i print it without decompressing it, and how can i decompress it and print it?
Thanx
| [reply] |
| [reply] |
Could you elaborate on what you mean by "print a DNS packet answer"... Hexdump, or what format?
| [reply] |
No, i mean when receiving DNS packet, in the answer part it has the domain name compressed, right? i want to print that name, without decompressing it.
tanx
| [reply] |
binmode FILEHANDLE;
print FILEHANDLE $data;
| [reply]
[d/l] |
| [reply] |