DNSPKTFLOW(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

✨ DNSPKTFLOW ✨

okay bestie, gather round, because this is the dnspktflow manual page, it lives in section 1 of the manual (user commands, yk), and it's the User Contributed Perl Documentation corner of the world. it analyzes and draws DNS flow diagrams from a tcpdump file. yes really. she does all that. 💅

🌸 SYNOPSIS 🌸

dnspktflow -o output.png file.tcpdump

dnspktflow -o output.png -x -a -t -q file.tcpdump

like. that's it. two lines and you're already iconic. 🫶

🦋 DESCRIPTION 🦋

so here's the vibe: dnspktflow takes a tcpdump network traffic dump file, runs it through the tshark application, and then shows you the resulting DNS packet flows as a "flow-diagram" image. no cap.

she can give you a single image, or a whole series of images that you can then play in sequence like an animation. choose your fighter. 💫

and lowkey the origin story? dnspktflow was written as a debugging utility, to help trace DNS queries and responses — especially as they apply to DNSSEC-enabled lookups. she's a tool with a purpose, a main character with lore. periodt.

💜 REQUIREMENTS 💜

this app needs the following Perl modules and software components to work, bestie:

graphviz                  (http://www.graphviz.org/)
GraphViz                  (Perl module)
tshark                    (http://www.wireshark.org/)

and if you want to output screen presentations, you also need:

MagicPoint                (http://member.wide.ad.jp/wg/mgp/)

also — and this is the fun part — if the following modules are installed, a GUI interface gets enabled for communication with dnspktflow:

QWizard                   (Perl module)
Getopt::GUI::Long         (Perl module)

not me installing extra modules just for the GUI. 🙈

✨ OPTIONS ✨

dnspktflow takes a wide variety of command-line options, and they're grouped below into functional lil families: input packet selection, output file options, output visualization options, graphical options, and debugging. slay.

🎀 Input Packet Selection

these options decide which packets dnspktflow will select. the vibe check of the packet world.

  • -i STRING, --ignore-hosts=STRING — a regular expression of host names to ignore in the query/response fields.
  • -r STRING, --only-hosts=STRING — a regular expression of host names to analyze in the query/response fields.
  • -f, --show-frame-num — display the packet frame numbers.
  • -b INTEGER, --begin-frame=INTEGER — begin at packet frame NUMBER.

🍓 Output File Options

these ones decide the type and location of dnspktflow's output. where's the pic going, bestie.

  • -o STRING, --output-file=STRING — output file name (default: out%03d.png as PNG format.)
  • --fig — output format should be fig.
  • -O STRING, --tshark-out=STRING — save tshark output to this file.
  • -m, --multiple-outputs — one picture per request (use %03d in the filename.)
  • -M STRING, --magic-point=STRING — saves a MagicPoint presentation for the output.

🌈 Output Visualization Options:

these determine the specifics of dnspktflow's output. the ~aesthetics~ section.

  • --layout-style — selects the graphviz layout style to use (dot, neato, twopi, circo, or fdp).
  • -L, --last-line-labels-only — only show data on the last line drawn.
  • -z INTEGER, --most-lines=INTEGER — only show at most INTEGER connections.
  • -T, --input-is-tshark-out — the input file is already processed by tshark.

⭐ Graphical Options:

these decide which fields get included in dnspktflow's output.

  • -t, --show-type — shows message type in result image.
  • -q, --show-queries — shows query questions in result image.
  • -a, --show-answers — shows query answers in result image.
  • -A, --show-authoritative — shows authoritative information in result image.
  • -x, --show-additional — shows additional information in result image.
  • -l, --show-label-lines — shows lines attaching labels to lines.
  • --fontsize=INTEGER — Font Size

💀 Debugging:

these options may assist in debugging dnspktflow. when things are giving chaos instead of slay.

  • -d, --dump-pkts — dump data collected from the packets.
  • -h, --help — show help for command line options.

Copyright 2004-2013 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

🧚 AUTHOR 🧚

Wes Hardaker <hardaker@users.sourceforge.net>

🌟 SEE ALSO 🌟

Getopt::GUI::Long(3) Net::DNS(3) QWizard.pm(3)

http://dnssec-tools.sourceforge.net/

this page is from perl v5.42.0, dated 2025-07-23, and it's the DNSPKTFLOW(1) page, bestie. go trace some DNS flows, you've got this. 💖✨🦋
📦 where this page comes from