CLI tool to run SQL queries directly on PCAP files
https://www.dns-oarc.net/tools/packetq
A command line tool to run SQL queries directly on PCAP files, the results
can be outputted as JSON (default), formatted/compact CSV and XML.#
It also contain a very simplistic web-server in order to inspect PCAP files
remotely.
PacketQ was previously known as DNS2db but was renamed in 2011 when it was
rebuilt and could handle protocols other than DNS among other things.
-
1
derived packages
- Download package
-
Checkout Package
osc -A https://api.opensuse.org checkout network:utilities/packetq && cd $_
- Create Badge
Refresh
Refresh
Source Files
Filename | Size | Changed |
---|---|---|
packetq-1.4.1.tar.gz | 0000938470 916 KB | |
packetq.changes | 0000001853 1.81 KB | |
packetq.spec | 0000001741 1.7 KB |
Revision 2 (latest revision is 4)
- Update to version 1.4.1 * Fixed an issue with the in-memory representation of DNS records which was not initialized correctly and could cause the reuse of old data, especially if the record was incomplete (such as FormErr). - Update to version 1.4.0 * This release adds new fields for IP version and EDNS0 Client Subnet along with documentation updates, new usage (`--help`) and a buffer overflow check. Rework of the way OPT records are parsed has been done to make it easier to add support for other EDNS options in the future. New fields: + 'ip_version': The IP version as an int (4/6) + 'edns0_ecs': A bool that is true if Client Subnet (RFC7871) was found + 'edns0_ecs_family': An int with the address family + 'edns0_ecs_source': An int with the source prefix length + 'edns0_ecs_scope': An int with the scope prefix length + 'edns0_ecs_address': A textual representation of the address Bugfix: - 'get_ushort()' in DNS parsing was not checking length of buffer before accessing it. - Update to version 1.3.1 Fixes: * ICMP code to fill the tables was wrong and created segfault using normal select, aggregation or group functions. The code has been rewritten to work as the DNS code does and ICMP tests have been added. * Historically PacketQ parses all resource records but only saves the first and last record, this would overwrite EDNS information
Comments 0