gamelinux/passivedns

Total DNS records allocated is 0?

IDJack opened this issue · 1 comments

I use tcpdump to collect the dns traffic between the local DNS server and hosts in our university(not include the dns traffic between the local DNS server and upper DNS server) and store as pcap format.

I use passivedns1.0 to process the dns traffic. But there are some errors. Why the total DNS records allocated is zero? Why?

[] PassiveDNS 1.0
[
] By Edward Bjarte Fjellskål edward.fjellskaal@gmail.com
[] Using libpcap version 1.7.4
[
] Using ldns version 1.6.17
[*] Reading from file /home/jack/dnscap/data/20171106_00.pcap

-- Total DNS records allocated : 0
-- Total DNS assets allocated : 0
-- Total DNS packets over IPv4/TCP : 1943
-- Total DNS packets over IPv6/TCP : 0
-- Total DNS packets over TCP decoded : 0
-- Total DNS packets over TCP failed : 1943
-- Total DNS packets over IPv4/UDP : 1229462
-- Total DNS packets over IPv6/UDP : 0
-- Total DNS packets over UDP decoded : 0
-- Total DNS packets over UDP failed : 1229462
-- Total packets received from libpcap : 1969978
-- Total Ethernet packets received : 1969978
-- Total VLAN packets received : 0

[*] passivedns ended.

Would need to look at query+answer from the pcap....