Documentation
¶
Overview ¶
Command inspect decodes a DNS message and prints everything in it.
It exists because the hardest part of debugging a DNS problem is usually finding out what the octets on the wire actually say. Point it at a packet capture payload, paste a hex string into it, or pipe it the body of a DNS-over-HTTPS request, and it will tell you what each section contains, what EDNS options are present, and — when the message is malformed — exactly which octet the decoder rejected and why.
Input may be raw binary or hexadecimal, from a file, from a command-line argument, or from standard input; the encoding is detected unless a flag overrides it. A two-octet TCP length prefix (RFC 1035 section 4.2.2) is detected and stripped, so a message captured from a TCP stream or a zone transfer can be fed in unedited.
Usage:
inspect [flags] [file | hex] inspect capture.bin inspect f00d8180000100010000000003777777076578616d706c6503636f6d0000010001c00c000100010000012c00045db8d822 inspect -generic -dump capture.bin tshark -r capture.pcap -Y dns -T fields -e data | head -1 | inspect curl -s -H 'accept: application/dns-message' 'https://dns.google/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | inspect go run ./examples/query -hex example.com | sed -n 4p | inspect
The exit status is 0 when the message decoded, 1 when it did not, and 2 for a usage or input error — so it can be used as a validity check in a script.
Source Files