Method __init__

dshell/plugins/dns/dns.py:29–64

(self, *args, **kwargs)

class DshellPlugin(dnsplugin.DNSPlugin):

    def __init__(self, *args, **kwargs):
        super().__init__(
            name="DNS",
            description="Extract and summarize DNS queries/responses",
            longdescription="""
The DNS plugin extracts and summarizes DNS queries and their responses. If
possible, each query is paired with its response(s).

Possible anomalies can be found using the --dns_show_noanswer,
--dns_only_noanswer, --dns_show_norequest, or --dns_only_norequest flags
(see --help).

For example, looking for responses that did not come from a request:
    decode -d dns --dns_only_norequest

Additional information for responses can be seen with --dns_country and
--dns_asn to show country codes and ASNs, respectively. These results can be
piped to grep for filtering results.

For example, to look for all traffic from Germany:
    decode -d dns --dns_country |grep "country: DE"

To look for non-US traffic, try:
    decode -d dns --dns_country |grep "country:" |grep -v "country: US"
""",
            author="bg/twp",
            bpf="udp and port 53",
            output=AlertOutput(label=__name__),
            optiondict={'show_noanswer': {'action': 'store_true', 'help': 'report unanswered queries alongside other queries'},
                        'show_norequest': {'action': 'store_true', 'help': 'report unsolicited responses alongside other responses'},
                        'only_noanswer': {'action': 'store_true', 'help': 'report only unanswered queries'},
                        'only_norequest': {'action': 'store_true', 'help': 'report only unsolicited responses'},
                        'country': {'action': 'store_true', 'help': 'show country code for returned IP addresses'},
                        'asn': {'action': 'store_true', 'help': 'show ASN for returned IP addresses'},
                    }
        )

    def premodule(self):
        if self.only_norequest: