Dnswatch updated

[HalilDeniz]

hello everyone,
In the update I made, I added a pcap file recording feature so that you can check the data that the dnswatch program listens to later with programs such as Wireshark, etc.
Don't forget to share your thoughts with me after updating the tool.

[Phil353556]

That's great !!!
I will test tomorrow.
Thank you

[HalilDeniz]

you're the best

[Phil353556]

Hi @HalilDeniz,

First it works :-) so that's great
now my feedbacks,
tested on Raspberry Pi 4 Model B Rev 1.2, with Kernel: 5.10.103-v7l+ and OS: Raspbian GNU/Linux 10 (buster) armv7l

requirements
still not clear enough, I think it depends really of the target plaform

$ pip list| egrep "scapy|argparse|requests" 
requests          2.21.0     
requests-oauthlib 1.0.0      
scapy             2.4.0      

$ dpkg -l | grep scapy
ii  python3-scapy                         2.4.0-2                                            all          Packet generator/sniffer and network scanner/discovery (Python 3)

About file setup.py
should it be use or not?
I didn't use it to make the test

Same question for dnsdata.py and init.py
ha ha, should be in the same directory than the file dnswatch.py otherwise

Traceback (most recent call last):
  File "dnswatch.py", line 11, in <module>
    from dnsdata import DNSDataStorage
ModuleNotFoundError: No module named 'dnsdata'

So only two files are mandatory: dnsdata.py and dnswatch.py
using git clone: the directory and subdirectories for a total of 3280 Ko
catch only dnsdata.py (14131 bytes )and dnswatch.py (2618 bytes) : total is 16749 bytes

The output file (.pcap) is overwritten without any message :-(

sudo python3 dnswatch.py -i wlan0 -p dnswatch.pcap -o dns_results.txt --analyze-dns-types

		DNS Packet Sniffer started...
Saving captured packets to 'dnswatch.pcap'

datastorage
it seems that even without this parameter -d, --database , the db is created ?
command: sudo python3 dnswatch.py -i wlan0 -p dnswatch.pcap -o dns_results.txt --analyze-dns-types

Kind regards
Phil

[HalilDeniz]

First of all, thank you for your feedback,
When we install the program on the system with setup.py, problems occur due to Python versions.
for example.
When I install Kali with Python 3.11 on Linux, the program does not work,
However, when I install it with Python 3.8 on Mint Linux, it works fine,
I will share a small patch for this. as soon as possible
Since our tool has received many downloads and is used on various platforms, I make edits based on your feedback. so thank you again

[Phil353556]

Another test
I took the two files and try to run it on a laptop with ubuntu with 22.04.3 LTS (Jammy Jellyfish) under kernel 6.2.0-32-generic #32~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Aug 18 10:40:13 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

$ sudo python3 dnswatch.py -i wlan0 -p dnswatch.pcap -o dns_results.txt --analyze-dns-types
[sudo] Mot de passe de user : 
Traceback (most recent call last):
  File "/home/user/dns/dnswatch.py", line 7, in <module>
    from scapy.layers.dns import DNSQR, DNSRR
ModuleNotFoundError: No module named 'scapy'

$ sudo apt-get install python3-scapy 
[sudo] Mot de passe de user : 
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances... Fait
Lecture des informations d'état... Fait      
Les paquets supplémentaires suivants seront installés : 
  fonts-lato ipython3 python3-backcall python3-ipython python3-jedi python3-matplotlib-inline python3-parso python3-pickleshare python3-prompt-toolkit
  python3-traitlets python3-wcwidth sphinx-rtd-theme-common
Paquets suggérés :
  python-ipython-doc graphviz python3-pyx sox tcpreplay
Les NOUVEAUX paquets suivants seront installés :
  fonts-lato ipython3 python3-backcall python3-ipython python3-jedi python3-matplotlib-inline python3-parso python3-pickleshare python3-prompt-toolkit
  python3-scapy python3-traitlets python3-wcwidth sphinx-rtd-theme-common
0 mis à jour, 13 nouvellement installés, 0 à enlever et 20 non mis à jour.

it works:

$ sudo python3 dnswatch.py -i wlp4s0  -p dnswatch.pcap -o dns_results.txt --analyze-dns-types
		DNS Packet Sniffer started...
Saving captured packets to 'dnswatch.pcap'

	DNS Request:

~/dns$ ls -llart 
total 108
-rw-r--r--  1 user group  2618 sept. 14 10:33 dnsdata.py
-rw-r--r--  1 user group 14131 sept. 14 10:33 dnswatch.py
drwxr-xr-x 79 user group 24576 sept. 14 10:34 ..
drwxr-xr-x  2 root    root     4096 sept. 14 13:45 __pycache__
-rw-r--r--  1 root    root    22129 sept. 14 13:46 dns_results.txt
-rw-r--r--  1 root    root    20480 sept. 14 13:46 dnsdata.db
drwxrwxr-x  3 user group  4096 sept. 14 13:46 .
-rw-r--r--  1 root    root     5305 sept. 14 13:46 dnswatch.pcap

So scapy must be install via apt and not via pip

~/dns$ dpkg -l |grep scap
ii  python3-scapy                                  2.4.4-4ubuntu1                                   all          Packet generator/sniffer and network scanner/discovery (Python 3)

~/dns$ dpkg -l |grep argparse

~/dns$ dpkg -l |grep requests
ii  iputils-arping                                 3:20211215-1                                     amd64        Tool to send ICMP echo requests to an ARP address
ii  python3-requests                               2.25.1+dfsg-2ubuntu0.1                           all          elegant and simple HTTP library for Python3, built for human beings
ii  python3-requests-toolbelt                      0.9.1-1                                          all          Utility belt for advanced users of python3-requests

~/dns$ pip list|egrep "scapy|requests|argparse"
requests                 2.25.1
requests-toolbelt        0.9.1
scapy                    2.4.4

[Phil353556]

Another and last test
on Raspberry Pi 4 Model B Rev 1.4 with OS: Raspbian GNU/Linux 11 (bullseye) aarch64 and kernel 6.1.21-v8+

$ sudo python3 dnswatch.py -i wlan0   -p dnswatch.pcap -o dns_results.txt --analyze-dns-types
Traceback (most recent call last):
  File "/home/user/dnswatch.py", line 7, in <module>
    from scapy.layers.dns import DNSQR, DNSRR
ModuleNotFoundError: No module named 'scapy'

$ sudo apt-get install scapy
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'python3-scapy' instead of 'scapy'
The following package was automatically installed and is no longer required:
  libtinyxml2-8
Use 'sudo apt autoremove' to remove it.
The following additional packages will be installed:
  ipython3 libpcap0.8 tcpdump
Suggested packages:
  graphviz python3-pyx tcpreplay wireshark
The following NEW packages will be installed:
  ipython3 libpcap0.8 python3-scapy tcpdump
0 upgraded, 4 newly installed, 0 to remove and 8 not upgraded.
Need to get 3,497 kB of archives.
After this operation, 40.7 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y

It works, I noticed "Matplotlib is building the font cache; this may take a moment"

$ sudo python3 dnswatch.py -i wlan0   -p dnswatch.pcap -o dns_results.txt --analyze-dns-types
Matplotlib is building the font cache; this may take a moment.
        	DNS Packet Sniffer started...
Saving captured packets to 'dnswatch.pcap'
	DNS Request:

$ dpkg -l | egrep "scapy|argparse|requests"
ii  python3-requests                      2.25.1+dfsg-2                     all          elegant and simple HTTP library for Python3, built for human beings
ii  python3-requests-oauthlib             1.0.0-1.1                         all          module providing OAuthlib auth support for requests (Python 3)
ii  python3-responses                     0.12.1-1                          all          Utility library for mocking out the requests Python 3 library
ii  python3-scapy                         2.4.4-4                           all          Packet generator/sniffer and network scanner/discovery (Python 3)

$ pip list  | egrep "scapy|argparse|requests"
requests          2.25.1
requests-oauthlib 1.0.0
scapy             2.4.4

So scapy must be install via apt and not via pip

[HalilDeniz]

thank you for your feedback <3