queryparse(1)

🦋 queryparse — bestie edition 🦋

okay so you found queryparse(1), the General Commands Manual page, section 1, and I am SO glad you're here. pull up a chair. 💖

---

✨ NAME ✨

queryparse — extract DNS queries from pcap capture files. that's it. that's the whole job. and she does it flawlessly. 👑

---

✨ SYNOPSIS ✨

queryparse [-i input file ] [-o output file ] [-r recursion only ] [-R
parse responses ]

yes bestie, those brackets are optional-optional. mix and match. live your truth. 💅

---

✨ DESCRIPTION ✨

so queryparse is this tool designed to extract DNS queries from pcap-formatted packet capture files and save them in a form suitable for input to Nominum's dnsperf or resperf benchmarking tools. it's giving pipeline princess. it's giving "I make your benchmark data and I don't complain about it." 🎀

now, important tea ☕ — queryparse will only examine UDP packets. no TCP, no nothing. and currently it supports Ethernet and Cisco HDLC frame types. that's the whole roster. no cap.

---

✨ OPTIONS ✨

• -i filename — attempt to extract DNS queries from filename, which should be a pcap-formatted packet capture session (e.g., a file created by tcpdump or ethereal). basically "here's my little capture file, go off." 🫶
• -o filename — write queries to filename in a format suitable for input to Nominum's dnsperf or resperf benchmarking tools. this is the glow-up step. raw packets in, benchmark-ready queries out. ✨
• -r — keep queries that do not have the RD (recursion desired) flag set. this is useful when parsing packet captures from authoritative nameservers. when parsing captures from caching nameservers, do not use it unless you also want to parse the outgoing queries from the nameserver. defaults to discarding queries with RD=0. lowkey the most opinionated flag here and honestly? respect. 💅
• -R — parse responses (QR=1) instead of queries (QR=0). plot twist! we're flipping the script and looking at the replies instead. 🙈

---

✨ FILES ✨

None. literally none. she doesn't touch a single config file. she's low maintenance. 🌸

---

✨ ENVIRONMENT ✨

None. no environment variables, no sneaky secrets, no $QUERYPARSE_VIBES. nothing to memorize. 😌

---

✨ DIAGNOSTICS ✨

None. no diagnostics listed here, bestie. (yes I know, I wanted more too. 😭)

---

✨ BUGS ✨

None. listed, anyway. zero bugs on the record. main character energy fr fr. 👑

---

✨ AUTHOR ✨

Nominum, Inc. — the icon, the legend, the moment. 🫡

---

✨ SEE ALSO ✨

• dnsperf(1)
• resperf(1)
• pcap(3)
• tcpdump(8)

go read those next, iykyk. 🌈

---

and that's the whole page, babe. this was queryparse(1) from the General Commands Manual — no version string and no date printed on the footer, just the humble little queryparse(1) tag waving goodbye at the bottom. 💜 🦋 go extract some queries and slay. periodt. 💖