dpa(1)

💖 dpa(1) — the DNS Packet Analyzer, bestie edition 💖

okay so real talk: this is the dpa manual page from the General Commands Manual section (section 1, aka "commands you just type"), and she is everything. dpa stands for DNS Packet Analyzer — she reads your ip trace files and pulls apart every DNS packet in them like it's gossip. ✨

---

🦋 NAME 🦋

dpa — DNS Packet Analyzer. Analyze DNS packets in ip trace files 💅

---

🌸 SYNOPSIS 🌸

dpa [ OPTION ] TRACEFILE

---

✨ DESCRIPTION ✨

So dpa is used to analyze dns packets in trace files. No cap, that's literally her whole job. 🫶

She's got 3 main options, and the girlies need to know them:

• count
• filter
• count uniques (i.e. count all different occurrences) — this one is the "how many distinct vibes" option, iykyk 🌈

---

👑 OPTIONS 👑

• -c expressionlist — Count occurrences of matching expressions. It's giving tally marks but make it DNS. 🔥
• -f expression — Filter: only process packets that match the expression. Everything else? Not invited to the party. 🙈
• -h — Show usage.
• -p — Show the total number of correct DNS packets, and percentage of -u and -c values (of the total of matching on the -f filter. if no filter is given, percentages are on all correct dns packets). So yes, this one is percentage o'clock ⭐
• -of file — Write all packets that match the -f flag to file, as pcap data. 💾
• -ofh file — Write all packets that match the -f flag to file, in hexadecimal format, readable by drill. Fancy hex dump energy ✨
• -s — Show possible match names.
• -s matchname — show possible match operators and values for name.
• -sf — Only evaluate packets (in representation format) that match the -f filter. If no -f was given, evaluate all correct dns packets.
• -u matchnamelist — Count every occurrence of every value of the matchname (for instance, count all packetsizes, see EXAMPLES in ldns-dpa(1)). 🧚
• -ua — For every matchname in -u, show the average value of all matches. Behaviour for match types that do not have an integer value is undefined. 🚨 (yeah bestie, undefined means undefined, don't come for me)
• -uac — For every matchname in -u, show the average number of times this value was encountered.
• -um number — Only show the results from -u for values that occurred more than number times. Gatekeeping the little guys 💅
• -v level — Set verbosity to level (1-5, 5 being the highest). Mostly used for debugging. Turn it up to 5 for the full unhinged experience 🔊
• -notip file — Write packets that were not recognized as IP packets to file (as pcap data).
• -baddns file — Write dns packets that were too mangled to parse to file (as pcap data). 😭 the poor things
• -version — Show version and exit. Bye bestie 👋

---

🌈 LIST AND MATCHES 🌈

A <matchnamelist> is a comma separated list of match names (use -s to see possible match names). A <expressionlist> is a comma separated list of expressions. Comma separated, comma separated, say it with me — commas are the glue of this whole operation. 🍓

An expression has the following form:

<expr>: (<expr>)
        <expr> | <expr>
        <expr> & <expr>
        <match>

<match>:        <matchname> <operator> <value>

<operator>:      =    equal to <value>      !=   not equal to <value>
     >    greater than <value>      <    lesser than <value>
     >=   greater than or equal to <value>      <=   lesser than or equal to <value>      ~=   contains <value>

See the -s option for possible matchnames, operators and values. 🌸

---

🎀 EXAMPLES 🎀

Like, the actual receipts. Copy these exactly, bestie, I'm not kidding:

ldns-dpa -u packetsize -p test.tr

Count all different packetsizes in test.tr and show the percentages. 📊

ldns-dpa -f "edns=1&qr=0" -of edns.tr test.tr

Filter out all edns enable queries in test.tr and put them in edns.tr. 🫶

ldns-dpa -f edns=1 -c tc=1 -u rcode test.tr

For all edns packets, count the number of truncated packets and all their rcodes in test.tr.

ldns-dpa -c tc=1,qr=0,qr=1,opcode=QUERY test.tr

For all packets, count the number of truncated packets, the number of packets with qr=0, the number of packets with qr=1 and the number of queries in test.tr.

ldns-dpa -u packetsize -ua test.tr

Show all packet sizes and the average packet size per packet. Math class but make it iconic ✨

ldns-dpa -u srcaddress -uac test.tr

Show all packet source addresses and the average number of packets sent from this address.

sudo tcpdump -i eth0 -s 0 -U -w - port 53 | ldns-dpa -f qr=0 -sf

Print all query packets seen on the specified interface. Main character pipeline energy 🔥

---

💜 AUTHOR 💜

Written by Jelte Jansen for NLnetLabs. We stan. 👑

---

🐛 REPORTING BUGS 🐛

Report bugs to <dns-team@nlnetlabs.nl>. Tell them everything, they can handle it 💖

---

📜 COPYRIGHT 📜

Copyright (C) 2005 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. So like, she's free, but she's also not your mom. 🚨

---

and that's the whole page bestie — dpa(1), dated 1 Nov 2005, part of the dpa(1) family, and now you know her fr fr 💅✨🦋