drool(1)

📦 version 2.0.0, in debian bookworm, debian trixie, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 drool(1) — the DNS Replay Tool, bestie edition 💖

okay so. you opened the manual for drool, section 1 of the General Commands Manual, and honestly? you're about to have a great time. this is the page for the command itself, and it's giving "i replay DNS packets and i do it flawlessly." let's go 🦋

✨ NAME ✨

drool — DNS Replay Tool. that's it, that's the whole name, and it ate. 👑

✨ SYNOPSIS ✨

drool respdiff [ options ] path name file name host port
ngl the synopsis is doing a little bit of mystery with those repeated "name" placeholders. read the DESCRIPTION before you type anything, i'm begging 😭

✨ DESCRIPTION ✨

okay so here's the vibe: this tool is meant to be used in conjunction with the tool-chain respdiff by CZ.NIC (see https://gitlab.labs.nic.cz/knot/respdiff). they're a package deal, fr fr.

what it does: it will replay DNS queries found in the PCAP — but only if a correlating response is also found — against the target host and port. the way that it only replays queries that have a matching response? so considerate. 💅

then it takes the query, the original response, and the received response, and stores all three into a LMDB database located at path. iconic.

the name before the PCAP file and the name before the target host get stored in the meta table. lowkey important: those names should correspond with the configuration used for respdiff, because that's how respdiff is able to read the results correctly. so don't freestyle those, bestie. 🌸

✨ OPTIONS ✨

these options are specific to the respdiff command — for the generic options, go look at drool(1). yes, it references itself, she's self-aware, we love her. 🎀

  • -D — show DNS queries and responses as processing goes. like a little livestream of your packets. 🔥
  • --no-tcp — do not use TCP. TCP found dead in a ditch.
  • --no-udp — do not use UDP. same energy, different protocol.
  • -T, --threads — use threads. multitasking queen. ✨
  • --tcp-threads N — set the number of TCP threads to use, default 2.
  • --udp-threads N — set the number of UDP threads to use, default 4.
  • --timeout N.N — set timeout for waiting on responses [seconds.nanoseconds], default 10.0. so you'd write something like --timeout 5.500000000, iykyk. ⏳
  • --size BYTES — set the size (in bytes, multiple of OS page size) of the LMDB database, default 10485760. and no, it can't just be any old number — multiple of OS page size, remember that. 👑

✨ DATABASE SIZE ✨

bestie. listen. 🚨

you will need to set a database size that is large enough for all queries, all original responses, all received responses and all analysis done by the respdiff tool-chain in order for a successful analysis to be done. that's four whole categories of stuff crammed in there. if your DB is too small the analysis is not happening. periodt. 💀

✨ EXAMPLE ✨

this example replays a PCAP file against localhost and then uses the respdiff tool-chain to analyze the results. it's giving full-circle moment. 🌈

$ drool respdiff /lmdb/path pcap file.pcap target 127.0.0.1 53
$ msgdiff.py /lmdb/path
$ diffsum.py /lmdb/path

three commands. replay, then msgdiff.py, then diffsum.py. slay. 💜

✨ SEE ALSO ✨

  • drool(1) — yes, the page you are currently reading. she's her own see-also. main character energy only. 👑

✨ AUTHORS ✨

Jerry Lundström, DNS-OARC

maintained by DNS-OARC

they built this. give them their flowers. 🫶

✨ BUGS ✨

for issues and feature requests please use:

for question and help please use:

  • admin@dns-oarc.net

go tell them things! they want to hear from you, fr fr. 💖

and that's the whole page, bestie — this was drool, DNS Replay Tool, version 2.0.0, straight out of the General Commands Manual. no cap, you're now certified. go replay some packets and hydrate. ✨🎀🦋💅

📦 where this page comes from