zmap/zdns

Header flags in A lookups

Closed this issue · 1 comments

I noticed ZDNS does not provide header flags (QR, RD, RA, etc) that you would see if you ran dig.

dig A "google.com" @8.8.8.8:
; <<>> DiG 9.16.1-Ubuntu <<>> A google.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8082
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 300 IN A 142.250.72.206

;; Query time: 16 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Feb 17 22:32:52 UTC 2024
;; MSG SIZE rcvd: 55

With ZDNS, echo "google.com" | ./zdns A --name-servers=8.8.8.8:

{
"data":
{"additionals":[{"flags":"","type":"EDNS0","udpsize":512,"version":0}],
"answers":[{"answer":"142.251.214.142","class":"IN","name":"google.com","ttl":102,"type":"A"}],
"protocol":"udp",
"resolver":"8.8.8.8:53"},
"name":"google.com",
"status":"NOERROR",
"timestamp":"2024-02-17T22:33:07Z"
}

I expected the ZDNS A module to be similar to dig, and it would be useful to have the flags. If there’s a way to get the flags that I’m not aware of, please let me know

This hidden in the default output, but you can request it if you'd like:

❯ echo "google.com" | ./zdns A --name-servers=8.8.8.8 --result-verbosity=long | jq .
{
  "class": "IN",
  "data": {
    "additionals": [
      {
        "flags": "",
        "type": "EDNS0",
        "udpsize": 512,
        "version": 0
      }
    ],
    "answers": [
      {
        "answer": "142.250.189.206",
        "class": "IN",
        "name": "google.com",
        "ttl": 163,
        "type": "A"
      }
    ],
    "flags": {
      "authenticated": false,
      "authoritative": false,
      "checking_disabled": false,
      "error_code": 0,
      "opcode": 0,
      "recursion_available": true,
      "recursion_desired": true,
      "response": true,
      "truncated": false
    },
    "protocol": "udp",
    "resolver": "8.8.8.8:53"
  },
  "name": "google.com",
  "status": "NOERROR",
  "timestamp": "2024-02-17T14:49:42-08:00"
}