["Pascal Chauffour" <CHAUFFOU@xxxxxxxxxx>]

This is true that some DNS traffic can flow thru TCP port 53 but this is
dedicated to downloads between DNS servers, the DNS traffic I try to
capture (queries) is going thru the UDP port 53.

In fact the filter "port 53" shall work for both cases TCP or UDP...

With kind regards
Pascal Chauffour



                                                                                                                                    
                      "Bates, Curtis"                                                                                               
                      <Curtis.Bates@age        To:       Pascal Chauffour/France/IBM@IBMFR, ethereal-users@xxxxxxxxxxxx             
                      dwards.com>              cc:                                                                                  
                                               Subject:  RE: [Ethereal-users] Capture filter syntax                                 
                      21/03/2003 14:58                                                                                              
                                                                                                                                    
                                                                                                                                    



DNS can use TCP to send queries.


-----Original Message-----
From: Pascal Chauffour [mailto:CHAUFFOU@xxxxxxxxxx]
Sent: Friday, March 21, 2003 3:57 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Capture filter syntax






My workstation is a Thinkpad connected to an unswitched 16 MB/s token-ring
LAN, the DNS server is running on a distinct machine on the same subnet and

I did run the nslookup on my Thinkpad.


My Token-Ring adapter is an "IBM Turbo 16/4 Token-Ring PC Card 2" with an
IBM driver dated 1/3/2000 version 12.23.3.50.
I did check for the parameters and found nothing apart of a special
advanced parameter named "ShallowMode Receive" which was set to "yes", I
did try setting it to "no" & it did only degrade the situation in the sense

that the filter "proto \udp" was not capturing any frame as it was
capturing SNMP & NTP frames (NO DNS) in the other case...


This is what I is shown up concerning my nslookup command when running
Tethereal without filter:
(I did replaced the DNS address in the trace by "x.yyy.dn.s")
      7.890322 00:60:94:6e:8b:5e -> ff:ff:ff:ff:ff:ff ARP Who has
x.yyy.dn.s?  Tell x.yyy.56.178
      ...
      7.894668 00:04:ac:63:48:99 -> 00:60:94:6e:8b:5e ARP x.yyy.dn.s is at
00:04:ac:63:48:99
      7.894732 x.yyy.56.178 -> x.yyy.dn.s   DNS Standard query PTR
5.40.100.9.in-addr.arpa
      7.898062   x.yyy.dn.s -> x.yyy.56.178 DNS Standard query response PTR

dnslge.lagaude.ibm.com
      ...
      7.905527 x.yyy.56.178 -> x.yyy.dn.s   DNS Standard query PTR
183.23.100.9.in-addr.arpa
      ...
      7.909004   x.yyy.dn.s -> x.yyy.56.178 DNS Standard query response PTR

mymachine.lagaude.ibm.com


In summary, the status of the different trials:
|------------------------+------------------------+------------------------|

|Commands                |Thinkpad Win2000 with   |Thinkpad Win2000 with
|
|                        |IBM Turbo 16/4 TR PC    |IBM Turbo 16/4 TR PC
|
|                        |Card 2 (ShallowMode     |Card 2 (ShallowMode
|
|                        |Receive="yes")          |Receive="no")
|
|------------------------+------------------------+------------------------|

|tethereal               |OK                      |OK
|
|------------------------+------------------------+------------------------|

|tethereal -f "proto     |only SMTP & NTP packets |No packets
|
|\udp"                   |(no DNS)                |
|
|------------------------+------------------------+------------------------|

|tethereal -f "proto     |OK                      |OK
|
|\icmp"                  |                        |
|
|------------------------+------------------------+------------------------|











                      Guy Harris


                      <guy@xxxxxxxxxx>         To:       Pascal
Chauffour/France/IBM@IBMFR


                                               cc:
ethereal-users@xxxxxxxxxxxx


                      20/03/2003 20:50         Subject:  Re:
[Ethereal-users] Capture filter syntax












On Thu, Mar 20, 2003 at 12:11:47PM +0100, Pascal Chauffour wrote:
> I did try Ethereal without capture filter and it worked well.


Did it capture any unicast traffic (not broadcast and not multicast)
that was neither sent to the machine running Ethereal or from the
machine running Ethereal?


> Then to avoid
> recording too much packets I did try using the capture filter "port 53"
but
> I could not capture anything.
> I first did the trial with Ethereal using the GUI and then I tried using
> Tethereal on a DOS box with the following command:
> tethereal -f "port 53" and I got a message telling the capture was
started
> "Capturing on \Device\NPF_{4D99DD04-CFB5-4973-BB80-602D8927503D}" but I
> could not see any packet despite running several nslookup commands.


Did you run nslookup *on the machine running Ethereal/Tethereal*?  (I
assume the DNS server wasn't running on that machine.)


If not, then is the token-ring LAN switched?


If so, then does that mean that unicast traffic from one station on the
LAN to another station on the LAN can be seen by a third station on the
LAN?  If not, that's the standard switching problem.


If the LAN isn't switched, is this your interface a Madge token-ring
cards?  If so, it might have promiscuous mode disabled:





http://www.madge.com/_assets/downloads/lsshelp8.0/LSSHelp/AdvFeat/Promisc/Promisc2.htm










_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users




***********************************************************************************

WARNING: All e-mail sent to and from this address will be received or
otherwise recorded by the A.G. Edwards corporate e-mail system and is
subject to archival, monitoring or review by, and/or disclosure to,
someone other than the recipient.
************************************************************************************