NAME

       drool - DNS Replay Tool

SYNOPSIS

       drool respdiff [ options ] path name file name host port

DESCRIPTION

       This  tool  is  to  be  used  in  conjunction  with the tool-chain respdiff by CZ.NIC (see
       https://gitlab.labs.nic.cz/knot/respdiff).

       It will replay DNS queries found in the PCAP, but only if a correlating response  is  also
       found,  against  the  target host and port.  The query, original response and the received
       response is then stored into a LMDB database located at path.  The name  before  the  PCAP
       file  and  the  name  before  the  target  host  are stored in the meta table which should
       correspond with the configuration use for respdiff in order for it to be able to read  the
       results correctly.

OPTIONS

       These options are specific for the respdiff command, see drool(1) for generic options.

       -D     Show DNS queries and responses as processing goes.

       --no-tcp
              Do not use TCP.

       --no-udp
              Do not use UDP.

       -T --threads
              Use threads.

       --tcp-threads N
              Set the number of TCP threads to use, default 2.

       --udp-threads N
              Set the number of UDP threads to use, default 4.

       --timeout N.N
              Set timeout for waiting on responses [seconds.nanoseconds], default 10.0.

       --size BYTES
              Set  the  size  (in  bytes, multiple of OS page size) of the LMDB database, default
              10485760.

DATABASE SIZE

       Note that you will need to set a database size that is large enough for all  queries,  all
       original responses, all received responses and all analysis done by respdiff tool-chain in
       order for a successful analysis to be done.

EXAMPLE

       This example replays a PCAP file against localhost and then uses the  respdiff  tool-chain
       to analyze the results.

         $ drool respdiff /lmdb/path pcap file.pcap target 127.0.0.1 53
         $ msgdiff.py /lmdb/path
         $ diffsum.py /lmdb/path

SEE ALSO

       drool(1)

AUTHORS

       Jerry Lundström, DNS-OARC

       Maintained by DNS-OARC

              https://www.dns-oarc.net/

BUGS

       For issues and feature requests please use:

              https://github.com/DNS-OARC/drool/issues

       For question and help please use:

              admin@dns-oarc.net