drool(1)

🦋 drool(1) — the DNS Replay Tool, bestie edition 💅

okay so before we even get into it: this is drool(1) from the General Commands Manual, and it's genuinely one of those tools that looks scary and is actually iconic once you get it. it's giving "I replay DNS traffic and I'm fast about it." no cap. 💖

---

✨ NAME ✨

drool — DNS Replay Tool 🌸

---

🎀 SYNOPSIS 🎀

drool replay [ options ] file host port

---

💜 DESCRIPTION 💜

so drool can replay DNS traffic from packet capture (PCAP) files and send it to a specified server. and bestie, it has options — you can manipulate the timing between packets, and you can loop packets infinitely or for a set number of iterations. its whole goal? producing a high amount of UDP packets per second and TCP sessions per second on common hardware. that's the dream. that's the assignment. 🔥

the purpose, and I'm quoting the vibe here: to simulate Distributed Denial of Service (DDoS) attacks on the DNS, and to measure normal DNS querying. for example 🫶 the tool could let you take a snapshot of a DDoS and then replay it later to test if new code or hardening techniques are useful, safe & effective. another example: replaying a packet stream for a bug that's sequence- and/or timing-related, so you can validate the efficacy of the bug fixes that came after. literally so useful. not me being obsessed with a packet replayer. 🙈

---

✨ OPTIONS ✨

these options are specific for the replay command — for generic options, go see drool(1).

• -D — show DNS queries and responses as processing goes. it's giving live commentary. 💅
• -n, --no-responses — do not wait for responses before sending the next request.
• --no-tcp — do not use TCP.
• --no-udp — do not use UDP.
• -T, --threads — use threads. ⭐
• --tcp-threads N — set the number of TCP threads to use, default 2.
• --udp-threads N — set the number of UDP threads to use, default 4.
• --timeout N.N — set the timeout for waiting on responses [seconds.nanoseconds], default 10.0.
• -t, --timing mode[=option] — set the timing mode, see TIMING MODES down below. 🦋

---

🌈 EXAMPLES 🌈

drool replay --timing multiply=0.5 --no-tcp file.pcap 127.0.0.1 53

send all DNS queries twice as fast as found in the PCAP file to localhost using UDP. zoom zoom. ✨

drool replay --timing keep --no-udp file.pcap 127.0.0.1 53

send all DNS queries over TCP to localhost as they were recorded. we're being faithful to the source material. 💖

drool replay --no-tcp --no-responses --threads --udp-threads 3 file.pcap 127.0.0.1 53

take all DNS queries found in the PCAP file and send them as fast as possible over UDP to localhost — by ignoring both timings and replies, and starting 3 threads that will simultaneously send queries. three girls sending packets at once. main character energy, honestly. 👑

---

💅 TIMING MODES 💅

• ignore — set the timing mode to ignore all timings and try to send traffic as fast as possible. this is the default. 🚀
• keep — set the timing mode to try and keep up with the interval between the traffic received.
• add=<nanoseconds> — set the timing mode to add the given nanoseconds to the interval between the traffic received.
• reduce=<nanoseconds> — set the timing mode to reduce the interval between the traffic received with the given nanoseconds.
• multiply=<float> — set the timing mode to multiply the interval between the traffic received. think of it as percent: 1.00 is 100% of the interval, 2.00 is 200%, 0.10 is 10%, and so on.
• fixed=<nanoseconds> — set the timing between packets to the given nanoseconds.

---

🌸 SEE ALSO 🌸

drool(1)

---

🫶 AUTHORS 🫶

Jerry Lundström, DNS-OARC 💜

Maintained by DNS-OARC ✨

https://www.dns-oarc.net/

---

😭 BUGS 😭

for issues and feature requests please use:

https://github.com/DNS-OARC/drool/issues

for questions and help please use:

admin@dns-oarc.net

lowkey if something's broken, don't suffer in silence bestie — hit the issue tracker or the email. 🍓

---

and that's the whole page!! this one's the DNS Replay Tool, version 2.0.0, from the drool(1) manual. go forth and replay responsibly, mwah 💋🧚💖