[Bro] Questions about Bro's DNS Parser

[daniela.miao at utoronto.ca]

Hey Seth,

Sorry about the delay in response, there is some confidentiality issue  
involved so I had to first get the okay from my supervising professor.

Anyhow, I have attached a sample capture from the trace file, which  
contains DNS packets with returned errors (some response packets). I  
also took a look at dns.bro, if I'm not mistaken the parser does not  
have any error code interpreting feature, it seems all to be group  
into Weird::WEIRD_FILE. I suspect I'll just have to redefine that  
object.

Thank you very much for your help,

Daniela

Quoting Seth Hall <hall.692 at osu.edu>:

>
> On Jan 24, 2010, at 11:17 PM, daniela.miao at utoronto.ca wrote:
>
>> bro -r test.pcap dns
>>
>> I believe this is correct?
>
>
> Yes, that should be correct.  Can you share the tracefile?
>
>   .Seth
>
> ---
> Seth Hall
> Network Security - Office of the CIO
> The Ohio State University
> Phone: 614-292-9721


-------------- next part --------------
???          ??  
   ?~kI? G   G    ?? 
w? E
 9?d  9??@??/	?5 %?a;
  
      3f0x03biz  
 
?~kI5?  G     ^ 
f ?? E  9?? ?  ?/	@? 5?%  a;?? 
      3f0x03biz  
 
?~kIG?  U    ?? 
w? E  G?M@ ?
=?	? 5 3
4Sl
  
      
792159189in-addrarpa   
?~kIH?  Q    ?? 
w? E  C?R@ ?_
J?/	? 5 /??n
  
      photos-hakfbcdnnet  
 
?~kI? U   U     ^ 
f ?? E  G?@ ?  ?/	???? 5 3  ??   
      
792159189in-addrarpa   
?~kIN?  ?    ^ 
f ?? E  ??@ ?  ?/	A_
J 5? ?  ?n?? 
     photos-hakfbcdnnet  
 
?  
  ?photos-dakfacebookcom	edgesuite??  
  *? a998mm1akamai?? 
 
    `y
? 
 
    `y#?~kI
? G   G    ?? 
w? E  9'@ ?\2??/	? 5 %%?
  
      
i
lcnnnet  
 
?~kI?? N   N     ^ 
f ?? E  @? ?  ?/	???t 5 ,  ?  
      a1642
gakamainet  
 
?~kI? Q   Q    ?? 
w? E  C
??9A_?p?/	?5 /?<
  
      brmw023	chemetallnet   
?~kI? Q   Q     ^ 
f ?? E  C?@ ?  ?/	?M7?? 5 /  ?  
      brmw023	chemetallnet   
?~kI?   d    ?? 
w? E
 V\  :?F&?/	? B??
      NOM-D1BE5F559C7
no-domain-set
bellcanada  
 
?~kIA ?   ?     ^ 
f ?? E  ?j? ?  ?/	F&??  ? 
   
  NOM-D1BE5F559C7
no-domain-set
bellcanada  
 
   
  m @
AROOT-SERVERSNET NSTLDVERISIGN-GRSCOM w?     ? 	:? 
Q??~kIp H   H    ?? 
w? E  :?@ ??4Y?/	? 5 &?6?
  
      llatdmtcom  
 
?~kI? ?   ?     ^ 
f ?? E  }!?@ ?  ?/	E?4Y 5? i  ??? 
     llatdmtcom  
 
?  
   ? atlasdmtvollnwdnet ? 
 
   ? ??	? 
 
   ? ??I?~kI? X   X    ?? 
w? E  J 
@ ????/	? 5 6???
      193234164207IN-ADDRARPA   
?~kI? X   X    ?? 
w? E  J??E?oH?/	? 6F#?
  
      stumbleuponstumble-uponcom  
 
?~kI:	 ?   ?     ^ 
f ?? E  s!?@ ?  ?/	F?? 5? _  ??
 
    193234164207IN-ADDRARPA   
?  
 
<?toroon63dnsvp1srvrbellca ?~kI`	 n   n    ??  ^ 
e E  `  @ 8?i???/	 5?t L???  
     a1642
gakamainet  
 
? 
 
    `y? 
 
    `y?~kI?	 ??  ^ 
f ?? E  ?@ ?  ?/	E?oH 5?  ??? 
     stumbleuponstumble-uponcom  
 
?  
   
stumble-uponcom1122o7net ? 
 
  
l B?? 
 
  
l B?? 
 
  
l B?? 
 
  
l B?? 
 
  
l B?? 
 
  
l B?? 
 
  
l B??~kI.
 ?   ?     ^ 
f ?? E  ?!?@ ?  ?/	A\2? 5? ?  ??? 
     
i
lcnnnet  
 
?  
   

icdnturnercom	edgesuite??  
  <? a1642
gakamai?? 
 
    `y? 
 
    `y?~kI9 U   U    ?? 
w? E  G?9D.E??	??5 3|5AX
  
      141133572IN-ADDRARPA   
?~kI? U   U     ^ 
f ?? E  G!?@ ?  ?/	?0??? 5 3  :f   
      141133572IN-ADDRARPA   
?~kIH L   L     ^ 
f ?? E  >?j@ ?  ?/	A\ 5?*  ??? 
      wwwbhejacrycom  
 
?~kIh L   L     ^ 
f ?? E  >?k@ ?  ?/	A\ 5?*  ??? 
      wwwbhejacrycom  
 
?~kI? X   X    ?? 
w? E  J@
@ ??c??/	? 5 6TG
  
      193234164207IN-ADDRARPA   
?~kI? T   T    ?? 
w? E  F  :qF0BF?/	?5 2p'{V
  
      wwwbestsampleresumecom  
 
?~kI ?   ?     ^ 
f ?? E  s!?@ ?  ?/	E?c? 5? _  G?? 
 
    193234164207IN-ADDRARPA   
?  
 
<?toroon63dnsvp1srvrbellca ?~kIJ d   d     ^ 
f ?? E  V!?@ ?  ?/	F0BF 5?B  {V?? 
 
    wwwbestsampleresumecom  
 
? 
 
  
? H??~kI? [   [    ?? 
w? E  M.?9???/	? 9?gJ
  
      Hilary
no-domain-set
bellcanada  
 
?~kI? ?   ?     ^ 
f ?? E  ??@ ?  ?/	@? 5?  gJ?? 
   
  Hilary
no-domain-set
bellcanada  
 
   
  ?@
AROOT-SERVERSNET NSTLDVERISIGN-GRSCOM w?     ? 	:? 
Q??~kI ?  ?   ??  ^ 
e E  ? @ 0???/	 5@??? 
 
  12519941216in-addrarpa   
?  
 
Q? 2
chi-dal-dhcpatriot-atm1-ws-378dsl	chibardunnet ?  
 
Q? ns2??  
 
Q? ns1?? 
 
  X ??? 
 
  X A??~kI ?   ?    ?? 
w? E  ?? @ 7?_?0??/	 5?? o??f? 
   
  141133572IN-ADDRARPA   
?  
  
  0ns1	fusepointcom dnsadm?Ikfs  @         
 ?~kI? G   G    ?? 
w? E  9?N  9Y?JD	?/	? %?
F=
  
      wwwbellca  
 
?~kI?   ?     ^ 
f ?? E  ?!?@ ?  ?/	?{s 5?? s  ??? 
 
    12519941216in-addrarpa   
?  
 
Q? 2
chi-dal-dhcpatriot-atm1-ws-378dsl	chibardunnet ?~kIR ?   ?     ^ 
f ?? E  ?!?@ ?  ?/	E???o  AX?? 
   
  141133572IN-ADDRARPA   
?  
  
  0ns1	fusepointcom dnsadm?Ikfs  @         
 ?~kI? W   W     ^ 
f ?? E  I!?@ ?  ?/	JD	 5?  F=?? 
 
    wwwbellca  
 
? 
 
    ???~kI? K   K    ?? 
w? E  =?? 9?_???/	?5 )?-
  
      metricsnflcom  
 
?~kIF ? ?   ^ 
f ?? E  ??  ?/	A_??5?? -?? 
 	    metricsnflcom  
 
?  
   ?nflcom1122o7net ? 
 
    B?? 
 
    B?? 
 
    B?? 
 
    B?? 
 
    B?? 
 
    B?? 
 
    B?? 
 
    B??~kI? K   K    ?? 
w? E  =?9?CG~??/	? )?i?
  
      
rkatalogropl  
 
?~kIS
 K   K     ^ 
f ?? E  =!?@ ?  ?/	?B?5 )  ?   
      
rkatalogropl  
 
?~kI^
 T   T    ??  ^ 
u E  F  @ 3????/	 5? 2??? 
      60699692in-addrarpa   
?~kI? T   T     ^ 
f ?? E  F?@ ?  ?/	ª
Qn 5 2  ??   
      60699692in-addrarpa   
?~kIZ ?  ?   ??  ^ 
e E  ?  @ 3?h?/	 5J? ???	? 
   
  1241335565_v480mymsnhotmailmsncom_ac_TRE-TRETIS16wrs
trendmicrocom   
?  
  X 3ns1?AllofTWURLfilteringdl?IH??  X   u   X?~kI? H   H    ?? 
w? E  :#?z
2F4??/	r?5 &??
  
      llatdmtcom  
 
?~kI?  ?    ^ 
f ?? E  ? ?@ ?  ?/	F6
? ?  &? 
   
  1241335565_v480mymsnhotmailmsncom_ac_TRE-TRETIS16wrs
trendmicrocom   
?  
  X 3ns1?AllofTWURLfilteringdl?IH??  X   u   X?~kIH  ?   ?     ^ 
f ?? E  }T@ ?  ?/	F4? 5r?i  /??? 
     llatdmtcom  
 
?  
   ? atlasdmtvollnwdnet ? 
 
   ? ??I? 
 
   ? ??	?~kIT  L   L    ?? 
w? E  >+@ ?GV_?/	? 5 * 3??
  
      cdnmapquestcom  
 
?~kI?  N   N     ^ 
f ?? E  @? ?  ?/	???
 5 ,  ?   
      a1044
gakamainet  
 
?~kI? S   S    ?? 
w? E  Ex   x??@??/	; 5 1? 
      
AIR_CANADA	aircanadaca  
 
?~kI)" ?   ?     ^ 
f ?? E  |!?@ ?  ?/	@? 5; h   ?? 
   
  
AIR_CANADA	aircanadaca  
 
?  
  9 +dns1mtsnet mtsdns?w?ZU    ? 	:?