How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:tshark -r capture.cap -T fields -e ip.src -e ip.dst -e dns.qry.name -R "dns.flags.response eq 0"
How would I also filter by ANY ?
Solution 1:
You would need to filter queries where the QTYPE is * (also known as ANY) (represented by the integer 255):
In WireShark or NetMon this would be
"dns.qry.type==255"
So for tshark
I assume it would be:
"dns.qry.type eq 255"
You can find the numerical values for all query types in RFC 1035 §3.2.3 "QTYPE Values"