Skip to content

Instantly share code, notes, and snippets.

@jrelo

jrelo/dns_tcpdumps.txt

Created August 21, 2024 17:48
Show Gist options
  • Save jrelo/93514c4cc4ed8011d0b3e84c0334ffc6 to your computer and use it in GitHub Desktop.
Save jrelo/93514c4cc4ed8011d0b3e84c0334ffc6 to your computer and use it in GitHub Desktop.
Download ZIP
dns tcpdumps
Raw
dns_tcpdumps.txt
DNS error responses:
sudo tcpdump -vv -i any port 53 and '(udp[10] & 0x80 != 0) and (udp[11] & 0x0F > 0)'
SPecific query types:
sudo tcpdump -vv -i any port 53 and 'udp[12:2] = 0x0100'
Long response times:
sudo tcpdump -vv -i any port 53 and greater 500
Malicious UDP traffic
sudo tcpdump -vv -i any not port 53 and 'udp[12:2] = 0x0100'
Specific domains:
sudo tcpdump -vv -i any port 53 and host example.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment