4

我正在尝试在 c# 中解码 DNS 数据包,虽然这并不重要,但我正在使用SharpPcap

一切正常,但似乎QRRCODE字段返回错误值。我正在将我的结果与 Wireshark 的结果进行比较。

即使消息是请求,QR 也始终为 1(响应)。发生的另一个奇怪的事情是,当消息是查询时返回码为 0,而当消息是响应时返回码为 1。

我用来查找 DNS 标头的网站之一就是这个。我在这里缺少什么吗?我用来解码数据包的代码是:(数据是一个包含有效负载数据的字节数组)

//TransactionID 16 bits (This is correct)
//Not sure why second byte has to be first but that's how wireshark displays it
transactionID = new byte[] { data[1], data[0] }; 

//Flags 16 bits
isResponse = Utilities.getBit(data[2], 0); //always returns 1

//What I'm doing here is converting the boolean returned by getBit into a
//1 or 0 which is used to create a string which will then be converted
//into a UInt16 (If there's an easier way to do this please let me know)
OpCode = Convert.ToUInt16(Convert.ToUInt16(Utilities.getBit(data[2], 1)).ToString() +
         Convert.ToUInt16(Utilities.getBit(data[2], 2)).ToString() +
         Convert.ToUInt16(Utilities.getBit(data[2], 3)).ToString() +
         Convert.ToUInt16(Utilities.getBit(data[2], 4)).ToString(), 2);

//These seem correct (Untested though since wireshark doesn't display them)
authAnswer = Utilities.getBit(data[2], 5);
truncation = Utilities.getBit(data[2], 6);
recursionDesired = Utilities.getBit(data[2], 7);

recursionAvail = Utilities.getBit(data[3], 0);
//skip 3 bits here (reserved and set to 0)...

//ReturnCode returns 0 for queries and 1 for responses, this is pretty weird
returnCode = Convert.ToUInt16(Convert.ToUInt16(Utilities.getBit(data[3], 4)).ToString() +
             Convert.ToUInt16(Utilities.getBit(data[3], 5)).ToString() +
             Convert.ToUInt16(Utilities.getBit(data[3], 6)).ToString() +
             Convert.ToUInt16(Utilities.getBit(data[3], 7)).ToString(), 2);

//Questions count, Answers count, ARR count, Additional ARR: 1 byte each
//These are correct
questionsCount = Convert.ToUInt16(data[4] * 256 + data[5]);
answersCount = Convert.ToUInt16(data[6] * 256 + data[7]);
authorityRRs = Convert.ToUInt16(data[8] * 256 + data[9]);
additionalRRs = Convert.ToUInt16(data[10] * 256 + data[11]);

getBit 方法在这里:

public static bool getBit(byte b, int index) {
    //Logical AND with number to find if bit is 0 or 1
    //Shift by index to represent value in binary (2^index)
    bool bit = (b & (1 << index)) != 0;

    return (bit);
}
4

1 回答 1

2

你试过使用Pcap.Net吗?它完全支持 DNS,因此您无需手动解码任何内容。

于 2013-03-22T07:55:27.907 回答