PcapParseC is always under development. It is a tool which the author want to use. License is described in JPRS-OSCL.txt.

Currently, the author uses it to count 'Number of possible DNSSEC validators', 'JP server selection of full-resolvers' and 'analysis of stub-resolvers'.

It can be used to analyze large pcap files which recorded DNS packets.

You can use PcapParse.c as a PCAP parser and you can evaluate anything you want to by writing C subroutine.

There is no documentation which describes how to use it as a library.

pcapDNSKEY.c and pcapgetquery.c are examples for PcapParse.c.

How to build:

autoreconf -i; ./configure; make; make install

Tested environment: FreeBSD 8.3 Linux (CentOS 5.6 and old RHEL) Solaris 10

How to use:

pcapgetquery reads pcap files and outputs BIND 9 style query logs. Or it can output CSV style query logs.

Usage: pcapgetquery [options] pcap files...

-A	Parse response packets

-L	BIND 9 querylog format
-C	CSV output
-c	Count mode

-D num	Debug flag
-4 v4	Specify DNS server's IPv4 address
-6 v6	Specify DNS server's IPv6 address
-e v4	Specify IPv4 address of excluded client
-m v4	Specify netmask for -a option
-a v4	Specify allowed client address prefix (IPv4 only)

pcapDNSKEY reads pcap files and counts that each query source IP address sent how many queries for JP, JP DNSKEY, any.JP DS, IN-ADDR.ARPA, *.IN-ADDR.ARPA DNSKEY, *.IN-ADDR.ARPA DS, *.BIND, *.SERVER and unknown TLDs.

Usage: pcapDNSKEY [options] pcap files...

-4 v4	Specify DNS server's IPv4 address
-6 v6	Specify DNS server's IPv6 address

Kazunori Fujiwara, Japan Registry Services Co., Ltd. fujiwara@jprs.co.jp, fujiwara@wide.ad.jp