dnsscope [OPTION]… INFILE


dnsscope takes an INFILE in PCAP format. It generates some simple statistics outputs these to STDOUT.


Path to a PCAP file.
-h, --help Show the help.
--rd Only process packets in INFILE with the RD (Recursion Desired) flag set. By default, we process all DNS packets in INFILE.
--ipv4=<state> Process IPv4 packets. On by default, disable with –ipv4 false.
--ipv6=<state> Process IPv6 packets. On by default, disable with –ipv6 false.
-f, --filter-name=<domain>
 Only process packets within this domain
--full-histogram <msec>
 Write out histogram with specified bin-size to ‘full-histogram’
 Write out a log-histogram of response times to ‘log-histogram’
 Remove servfail responses from latency statistics
--port The source and destination port to consider. Default is looking at packets from and to ports 53 and 5300.
 Figure out subtrees that generate servfails.
--stats-dir <directory>
 Drop statistics files in this directory. Defaults to ./
-l, --load-stats
 Emit per-second load statistics (questions, answers, outstanding).
-w <file>, --write-failures <file>
 Write weird packets to a PCAP file at FILENAME.
-v, --verbose Be more verbose.

See also

pcap(3PCAP), tcpdump(8)