0

I'm making a program using pcap to parse .pcap files.

I'm actually working on the DNS protocol, i'm able to get the header and display its information. Now I'd like to display its Resource Records (Question, Answer, Authority, Additional).

I found this interesting doc: http://www.zytrax.com/books/dns/ch15/

And, as I did before for parsing the different headers, I wanted to create a structure and cast my packet in it.

Following this doc I created my structure as follow:

struct question_s {
  u_short  *qname;
  u_short   qtype;
  u_short   qclass;
}

and I'm casting :

struct question_s *record = (struct question_s*)(data + offset);

Where data is the packet representation, and offset is the total size of previous protocols.

Now I'm having trouble understanding some points, and as my English is not perfect, it's possible that I missed something in the documentation. Here are my questions:

As qname is of variable size, am I doing it right by making it a pointer on u_short?

All pointer are 8 bytes long, so my structure should be 12 bytes long, but where is the name in memory? Should I add 12 to my offset without taking care of the name length?

I tried to display qname, working on it as if it was a char*, but it doesn't seem to work (seg. fault), here is what I did: 

void test(u_short *qname) {
  for (int c = 0; qname[c] != 0; ++c)
    write(1, &qname[c], 1);
}

But maybe there isn't a '\0' in the string?

May be that's an endianess issue? I use htons and htonl on all my u_short and u_int values because the network byte order isn't the same as mine, but I'm not sure it applies to pointers.

Thomas Dickey
  • 51,086
  • 7
  • 70
  • 105
Charrette
  • 690
  • 1
  • 11
  • 29

1 Answers1

2

If you want to see how to dissect DNS records, first read and understand RFC 1035, and then take a look at the tcpdump code to dissect DNS records. It's harder than you think; you can't just overlay a structure on top of the raw packet data.

And you can't ever overlay a structure with a pointer in it on top of raw packet data. The pointer will almost certainly point to some bogus location in your address space; protocols don't send raw pointers over the network, as a pointer is a pointer in a particular address space, and two processes on the network will have different address spaces.

(In fact, just about everything in packet dissection is harder than people think when they first try to write code to dissect packets.)

Community
  • 1
  • 1
  • Your explanation about the pointer makes sense ! I don't know what i was thinking. Thank you i'll read that and eventually come back to you later – Charrette Nov 01 '15 at 07:17