pax_global_header00006660000000000000000000000064127277744700014533gustar00rootroot0000000000000052 comment=c025a0894cb1c4693c307735d8a9590626516053 dnsdiag-1.4.0/000077500000000000000000000000001272777447000131465ustar00rootroot00000000000000dnsdiag-1.4.0/.gitignore000066400000000000000000000014171272777447000151410ustar00rootroot00000000000000# Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *$py.class .idea/ whois.cache # C extensions *.so # Distribution / packaging .Python env/ build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib/ lib64/ parts/ sdist/ var/ *.egg-info/ .installed.cfg *.egg # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .coverage .coverage.* .cache nosetests.xml coverage.xml *,cover .hypothesis/ # Translations *.mo *.pot # Django stuff: *.log # Sphinx documentation docs/_build/ # PyBuilder target/ #Ipython Notebook .ipynb_checkpoints dnsdiag-1.4.0/.gitmodules000066400000000000000000000003051272777447000153210ustar00rootroot00000000000000[submodule "cymruwhois"] path = cymruwhois url = https://github.com/JustinAzoff/python-cymruwhois.git [submodule "dnspython-orig"] path = dnspython url = https://github.com/rthalley/dnspython/ dnsdiag-1.4.0/.travis.yml000066400000000000000000000003471272777447000152630ustar00rootroot00000000000000language: python python: - "3.3" - "3.4" - "3.5" - "3.5-dev" # 3.5 development branch - "nightly" # currently points to 3.6-dev install: pip install --process-dependency-links dnsdiag script: nosetests dnstraceroute.py dnsdiag-1.4.0/LICENSE000066400000000000000000000024211272777447000141520ustar00rootroot00000000000000Copyright (c) 2016, Babak Farrokhi All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. dnsdiag-1.4.0/MANIFEST.in000066400000000000000000000001151272777447000147010ustar00rootroot00000000000000include LICENSE README.md TODO.md public-servers.txt include cymruwhois/*.py dnsdiag-1.4.0/README.md000066400000000000000000000143111272777447000144250ustar00rootroot00000000000000[![Build Status](https://travis-ci.org/farrokhi/dnsdiag.svg)](https://travis-ci.org/farrokhi/dnsdiag) [![PyPI](https://img.shields.io/pypi/v/dnsdiag.svg?maxAge=8600)](https://pypi.python.org/pypi/dnsdiag/) [![PyPI](https://img.shields.io/pypi/l/dnsdiag.svg?maxAge=8600)]() [![PyPI](https://img.shields.io/pypi/pyversions/dnsdiag.svg?maxAge=8600)]() [![GitHub stars](https://img.shields.io/github/stars/farrokhi/dnsdiag.svg?style=social&label=Star&maxAge=8600)](https://github.com/farrokhi/dnsdiag/stargazers) DNS Diagnostics and Performance Measurement Tools ================================================== Ever been wondering if your ISP is [hijacking your DNS traffic](https://decentralize.today/is-your-isp-hijacking-your-dns-traffic-f3eb7ccb0ee7#.fevks5wyc)? Ever observed any misbehavior with your DNS responses? Ever been redirected to wrong address and suspected something is wrong with your DNS? Here we have a [set of tools](http://github.com/farrokhi/dnsdiag) to perform basic audits on your DNS requests and responses to make sure your DNS is working as you expect. You can measure the response time of any given DNS server for arbitrary requests using `dnsping`. Just like traditional ping utility, it gives you similar functionality for DNS requests. You can also trace the path your DNS request takes to destination to make sure it is not being redirected or hijacked. This can be done by comparing different DNS queries being sent to the same DNS server using `dnstraceroute` and observe if there is any difference between the path. `dnseval` evaluates multiple DNS resolvers and helps you choose the best DNS server for your network. While it is highly recommended to use your own DNS resolver and never trust any third-party DNS server, but in case you need to choose the best DNS forwarder for your network, `dnseval` lets you compare different DNS servers from performance (latency) and reliability (loss) point of view. # prerequisites This script requires python3 as well as latest [dnspython](http://www.dnspython.org/) and [cymruwhois](https://pythonhosted.org/cymruwhois/). Please note that "dnstraceroute" requires a modified version of dnspython module. All required third-party modules are included as GIT submodules. You just need to run `git submodule update --init` and project directory to pull the required code. # installation There are several ways that you can use this toolset. However using the sourcecode is always recommended. ## From Source Code 1. You can checkout this git repo and its submodules ``` git clone https://github.com/farrokhi/dnsdiag.git cd dnsdiag git submodule update --init ``` 2. You can alternatively install the package using pip: ``` pip3 install --process-dependency-links dnsdiag ``` ## From Binary From time to time, binary version will be released for Windows, Mac OS X and Linux platforms. You can grab the latest release from [releases page](https://github.com/farrokhi/dnsdiag/releases). # dnsping dnsping pings a DNS resolver by sending an arbitrary DNS query for given number of times: ``` % ./dnsping.py -c 3 -s 8.8.8.8 -t MX wikipedia.org dnsping.py DNS: 8.8.8.8:53, hostname: wikipedia.org, rdatatype: MX 101 bytes from 8.8.8.8: seq=0 time=262.896 ms 101 bytes from 8.8.8.8: seq=1 time=305.608 ms 101 bytes from 8.8.8.8: seq=2 time=307.221 ms --- 8.8.8.8 dnsping statistics --- 3 requests transmitted, 3 responses received, 0% lost min=262.896 ms, avg=291.908 ms, max=307.221 ms, stddev=25.138 ms ``` This script calculates minimum, maximum and average response time as well as jitter (stddev) # dnstraceroute dnstraceroute is a traceroute utility to figure out the path that your DNS request is passing through to get to its destination. You may want to compare it to your actual network traceroute and make sure your DNS traffic is not routed to any unwanted path. ``` % ./dnstraceroute.py --expert -s 8.8.4.4 yahoo.com dnstraceroute.py DNS: 8.8.4.4:53, hostname: yahoo.com, rdatatype: A 1 204.109.58.53 (204.109.58.53) 1 ms 2 208.79.80.5 (208.79.80.5) 1 ms 3 162.223.13.177 (162.223.13.177) 1 ms 4 208.79.80.254 (208.79.80.254) 7 ms 5 eqixva-google-gige.google.com (206.126.236.21) 7 ms 6 209.85.242.142 (209.85.242.142) 7 ms 7 72.14.236.148 (72.14.236.148) 8 ms 8 209.85.250.70 (209.85.250.70) 16 ms 9 74.125.37.222 (74.125.37.222) 16 ms 10 * 11 google-public-dns-b.google.com (8.8.4.4) 15 ms === Expert Hints === [*] public DNS server is next to an invisible hop (probably a firewall) ``` Using `--expert` will instruct dnstraceroute to print expert hints (such as warnings of possible DNS traffic hijacking). # dnseval dnseval is a bulk ping utility that sends an arbitrary DNS query to a give list of DNS servers. This script is meant for comparing response time of multiple DNS servers at once: ``` % ./dnseval.py -f public-v4.txt -c3 ripe.net server avg(ms) min(ms) max(ms) stddev(ms) lost(%) flags ---------------------------------------------------------------------------------- 8.8.8.8 210.225 109.864 407.420 170.785 %0 QR RD RA 8.8.4.4 107.850 93.134 120.578 13.830 %0 QR RD RA ns.ripe.net 118.911 114.874 123.389 4.275 %0 QR AA RD 4.2.2.1 104.380 102.449 106.588 2.083 %0 QR RD RA 4.2.2.2 131.056 99.143 193.711 54.264 %0 QR RD RA 4.2.2.3 98.956 97.463 100.310 1.429 %0 QR RD RA 4.2.2.4 223.173 97.418 463.728 208.398 %0 QR RD RA 4.2.2.5 104.290 97.264 117.878 11.770 %0 QR RD RA ``` ### Author Babak Farrokhi - twitter: [@farrokhi](https://twitter.com/farrokhi) - github: [/farrokhi](https://github.com/farrokhi/) - website: [farrokhi.net](https://farrokhi.net/) ### License dnsdiag is released under a 2 clause BSD license. ### Credits - [@rthalley](https://github.com/rthalley) for invaluable [dnspython](https://github.com/rthalley/dnspython) library - [@JustinAzoff](https://github.com/JustinAzoff) for [python-cymruwhois](https://github.com/JustinAzoff/python-cymruwhois) library - [@bortzmeyer](https://github.com/bortzmeyer) for his feedback and patches dnsdiag-1.4.0/TODO.md000066400000000000000000000003641272777447000142400ustar00rootroot00000000000000# TODO - implement basic DNS client functionality into dnstraceroute to eliminate need of modified dnspython module - add support for python 2.x for the conservatives and faint-hearted ;-) - dnsfingerprint.py tool to fingerprint DNS servers dnsdiag-1.4.0/cymruwhois/000077500000000000000000000000001272777447000153575ustar00rootroot00000000000000dnsdiag-1.4.0/dns000077700000000000000000000000001272777447000164052dnspython/dnsustar00rootroot00000000000000dnsdiag-1.4.0/dnseval.py000077500000000000000000000170501272777447000151620ustar00rootroot00000000000000#!/usr/bin/env python3 # # Copyright (c) 2016, Babak Farrokhi # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. import getopt import ipaddress import os import signal import socket import sys import time from statistics import stdev import dns.rdatatype import dns.resolver __VERSION__ = 1.4 __PROGNAME__ = os.path.basename(sys.argv[0]) shutdown = False resolvers = dns.resolver.get_default_resolver().nameservers def usage(): print("""%s version %1.1f usage: %s [-h] [-f server-list] [-c count] [-t type] [-w wait] hostname -h --help show this help -f --file dns server list to use (default: system resolvers) -c --count number of requests to send (default: 10) -w --wait maximum wait time for a reply (default: 5) -t --type DNS request record type (default: A) """ % (__PROGNAME__, __VERSION__, __PROGNAME__)) sys.exit() def signal_handler(sig, frame): global shutdown if shutdown: # pressed twice, so exit immediately sys.exit(0) shutdown = True # pressed once, exit gracefully def maxlen(names): sn = sorted(names, key=len) return len(sn[-1]) def _order_flags(table): return sorted(table.items(), reverse=True) def flags_to_text(flags): # Standard DNS flags QR = 0x8000 AA = 0x0400 TC = 0x0200 RD = 0x0100 RA = 0x0080 AD = 0x0020 CD = 0x0010 # EDNS flags DO = 0x8000 _by_text = { 'QR': QR, 'AA': AA, 'TC': TC, 'RD': RD, 'RA': RA, 'AD': AD, 'CD': CD } _by_value = dict([(y, x) for x, y in _by_text.items()]) _flags_order = _order_flags(_by_value) _by_value = dict([(y, x) for x, y in _by_text.items()]) order = sorted(_by_value.items(), reverse=True) text_flags = [] for k, v in order: if flags & k != 0: text_flags.append(v) else: text_flags.append('--') return ' '.join(text_flags) def dnsping(host, server, dnsrecord, timeout, count): resolver = dns.resolver.Resolver() resolver.nameservers = [server] resolver.timeout = timeout resolver.lifetime = timeout resolver.retry_servfail = 0 flags = 0 answers = None resolver.use_edns(edns=True, payload=0, ednsflags=8) response_times = [] i = 0 for i in range(count): if shutdown: # user pressed CTRL+C break try: stime = time.time() answers = resolver.query(host, dnsrecord) # todo: response validation in future etime = time.time() except (dns.resolver.NoNameservers, dns.resolver.NoAnswer): break except dns.resolver.Timeout: pass else: elapsed = (etime - stime) * 1000 # convert to milliseconds response_times.append(elapsed) r_sent = i + 1 r_received = len(response_times) r_lost = r_sent - r_received r_lost_percent = (100 * r_lost) / r_sent if response_times: r_min = min(response_times) r_max = max(response_times) r_avg = sum(response_times) / r_received if len(response_times) > 1: r_stddev = stdev(response_times) else: r_stddev = 0 else: r_min = 0 r_max = 0 r_avg = 0 r_stddev = 0 if answers: flags = answers.response.flags return server, r_avg, r_min, r_max, r_stddev, r_lost_percent, flags def main(): try: signal.signal(signal.SIGTSTP, signal.SIG_IGN) # ignore CTRL+Z signal.signal(signal.SIGINT, signal_handler) # catch CTRL+C except AttributeError: # Some systems (e.g. Windows) may not support all signals pass if len(sys.argv) == 1: usage() # defaults dnsrecord = 'A' count = 10 waittime = 5 inputfilename = None fromfile = False hostname = 'wikipedia.org' try: opts, args = getopt.getopt(sys.argv[1:], "hf:c:t:w:", ["help", "file=", "count=", "type=", "wait="]) except getopt.GetoptError as err: print(err) usage() if args and len(args) == 1: hostname = args[0] else: usage() for o, a in opts: if o in ("-h", "--help"): usage() elif o in ("-c", "--count"): count = int(a) elif o in ("-f", "--file"): inputfilename = a fromfile = True elif o in ("-w", "--wait"): waittime = int(a) elif o in ("-t", "--type"): dnsrecord = a else: print("Invalid option: %s" % o) usage() try: if fromfile: with open(inputfilename, 'rt') as flist: f = flist.read().splitlines() else: f = resolvers if len(f) == 0: print("No nameserver specified") f = [name.strip() for name in f] width = maxlen(f) blanks = (width - 5) * ' ' print('server ', blanks, ' avg(ms) min(ms) max(ms) stddev(ms) lost(%) flags') print((84 + width) * '-') for server in f: # check if we have a valid dns server address if server.lstrip() == '': # deal with empty lines continue server = server.replace(' ', '') try: ipaddress.ip_address(server) except ValueError: # so it is not a valid IPv4 or IPv6 address, so try to resolve host name try: s = socket.getaddrinfo(server, port=None)[1][4][0] except OSError: print('Error: cannot resolve hostname:', server) s = None except: pass else: s = server if not s: continue (s, r_avg, r_min, r_max, r_stddev, r_lost_percent, flags) = dnsping(hostname, s, dnsrecord, waittime, count) s = server.ljust(width + 1) text_flags = flags_to_text(flags) print("%s %-8.3f %-8.3f %-8.3f %-8.3f %%%-3d %25s" % ( s, r_avg, r_min, r_max, r_stddev, r_lost_percent, text_flags), flush=True) except Exception as e: print('error: %s' % e) sys.exit(1) if __name__ == '__main__': main() dnsdiag-1.4.0/dnsping.py000077500000000000000000000173161272777447000151750ustar00rootroot00000000000000#!/usr/bin/env python3 # # Copyright (c) 2016, Babak Farrokhi # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. import getopt import ipaddress import os import signal import socket import sys import time from statistics import stdev import dns.flags import dns.rdatatype import dns.resolver __VERSION__ = 1.4 __PROGNAME__ = os.path.basename(sys.argv[0]) shutdown = False def usage(): print("""%s version %1.1f usage: %s [-h] [-q] [-v] [-s server] [-p port] [-P port] [-S address] [-c count] [-t type] [-w wait] hostname -h --help Show this help -q --quiet Quiet -v --verbose Print actual dns response -s --server DNS server to use (default: first entry from /etc/resolv.conf) -p --port DNS server port number (default: 53) -T --tcp Use TCP instead of UDP -4 --ipv4 Use IPv4 as default network protocol -6 --ipv6 Use IPv6 as default network protocol -P --srcport Query source port number (default: 0) -S --srcip Query source IP address (default: default interface address) -c --count Number of requests to send (default: 10) -w --wait Maximum wait time for a reply (default: 5) -t --type DNS request record type (default: A) """ % (__PROGNAME__, __VERSION__, __PROGNAME__)) sys.exit(0) def signal_handler(sig, frame): global shutdown if shutdown: # pressed twice, so exit immediately sys.exit(0) shutdown = True # pressed once, exit gracefully def main(): try: signal.signal(signal.SIGTSTP, signal.SIG_IGN) # ignore CTRL+Z signal.signal(signal.SIGINT, signal_handler) # custom CTRL+C handler except AttributeError: # OS Does not support some signals, probably windows pass if len(sys.argv) == 1: usage() # defaults dnsrecord = 'A' count = 10 timeout = 5 quiet = False verbose = False dnsserver = dns.resolver.get_default_resolver().nameservers[0] dst_port = 53 src_port = 0 src_ip = None use_tcp = False af = socket.AF_INET hostname = 'wikipedia.org' try: opts, args = getopt.getopt(sys.argv[1:], "qhc:s:t:w:vp:P:S:T46", ["help", "count=", "server=", "quiet", "type=", "wait=", "verbose", "port=", "srcip=", "tcp", "ipv4", "ipv6", "srcport="]) except getopt.GetoptError as err: # print help information and exit: print(err) # will print something like "option -a not recognized" usage() if args and len(args) == 1: hostname = args[0] else: usage() for o, a in opts: if o in ("-h", "--help"): usage() elif o in ("-c", "--count"): count = int(a) elif o in ("-v", "--verbose"): verbose = True elif o in ("-s", "--server"): dnsserver = a elif o in ("-p", "--port"): dst_port = int(a) elif o in ("-q", "--quiet"): quiet = True verbose = False elif o in ("-w", "--wait"): timeout = int(a) elif o in ("-t", "--type"): dnsrecord = a elif o in ("-T", "--tcp"): use_tcp = True elif o in ("-4", "--ipv4"): af = socket.AF_INET elif o in ("-6", "--ipv6"): af = socket.AF_INET6 elif o in ("-P", "--srcport"): src_port = int(a) if src_port < 1024: print("WARNING: Source ports below 1024 are only available to superuser") elif o in ("-S", "--srcip"): src_ip = a else: usage() # check if we have a valid dns server address try: ipaddress.ip_address(dnsserver) except ValueError: # so it is not a valid IPv4 or IPv6 address, so try to resolve host name try: dnsserver = socket.getaddrinfo(dnsserver, port=None, family=af)[1][4][0] except OSError: print('Error: cannot resolve hostname:', dnsserver) sys.exit(1) resolver = dns.resolver.Resolver() resolver.nameservers = [dnsserver] resolver.timeout = timeout resolver.lifetime = timeout resolver.port = dst_port resolver.retry_servfail = 0 response_time = [] i = 0 print("%s DNS: %s:%d, hostname: %s, rdatatype: %s" % (__PROGNAME__, dnsserver, dst_port, hostname, dnsrecord)) for i in range(count): if shutdown: break try: stime = time.time() answers = resolver.query(hostname, dnsrecord, source_port=src_port, source=src_ip, tcp=use_tcp, raise_on_no_answer=False) etime = time.time() except dns.resolver.NoNameservers as e: if not quiet: print("No response to dns request") if verbose: print("error:", e) sys.exit(1) except dns.resolver.NXDOMAIN as e: if not quiet: print("Hostname does not exist") if verbose: print("Error:", e) sys.exit(1) except dns.resolver.Timeout: if not quiet: print("Request timeout") pass except dns.resolver.NoAnswer: if not quiet: print("No answer") pass else: elapsed = (etime - stime) * 1000 # convert to milliseconds response_time.append(elapsed) if not quiet: print( "%d bytes from %s: seq=%-3d time=%3.3f ms" % ( len(str(answers.rrset)), dnsserver, i, elapsed)) if verbose: print(answers.rrset) print("flags:", dns.flags.to_text(answers.response.flags)) r_sent = i + 1 r_received = len(response_time) r_lost = r_sent - r_received r_lost_percent = (100 * r_lost) / r_sent if response_time: r_min = min(response_time) r_max = max(response_time) r_avg = sum(response_time) / r_received if len(response_time) > 1: r_stddev = stdev(response_time) else: r_stddev = 0 else: r_min = 0 r_max = 0 r_avg = 0 r_stddev = 0 print('\n--- %s dnsping statistics ---' % dnsserver) print('%d requests transmitted, %d responses received, %3.0f%% lost' % (r_sent, r_received, r_lost_percent)) print('min=%3.3f ms, avg=%3.3f ms, max=%3.3f ms, stddev=%3.3f ms' % (r_min, r_avg, r_max, r_stddev)) if __name__ == '__main__': main() dnsdiag-1.4.0/dnspython/000077500000000000000000000000001272777447000151745ustar00rootroot00000000000000dnsdiag-1.4.0/dnstraceroute.py000077500000000000000000000270321272777447000164110ustar00rootroot00000000000000#!/usr/bin/env python3 # # Copyright (c) 2016, Babak Farrokhi # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. import concurrent.futures import getopt import ipaddress import os import pickle import signal import socket import sys import time import dns.query import dns.rdatatype import dns.resolver from cymruwhois import cymruwhois __author__ = 'Babak Farrokhi (babak@farrokhi.net)' __license__ = 'BSD' __version__ = 1.4 _ttl = None quiet = False class CustomSocket(socket.socket): def __init__(self, *args, **kwargs): super(CustomSocket, self).__init__(*args, **kwargs) def sendto(self, *args, **kwargs): global _ttl if _ttl: self.setsockopt(socket.SOL_IP, socket.IP_TTL, _ttl) super(CustomSocket, self).sendto(*args, **kwargs) def test_import(): # passing this test means imports were successful pass # Constants __PROGNAME__ = os.path.basename(sys.argv[0]) WHOIS_CACHE = 'whois.cache' class Colors(object): N = '\033[m' # native R = '\033[31m' # red G = '\033[32m' # green O = '\033[33m' # orange B = '\033[34m' # blue def __init__(self, mode): if not mode: self.N = '' self.R = '' self.G = '' self.O = '' self.B = '' # Globarl Variables shutdown = False def whoisrecord(ip): try: currenttime = time.time() ts = currenttime if ip in whois: asn, ts = whois[ip] else: ts = 0 if (currenttime - ts) > 36000: c = cymruwhois.Client() asn = c.lookup(ip) whois[ip] = (asn, currenttime) return asn except Exception as e: return e try: pkl_file = open(WHOIS_CACHE, 'rb') try: whois = pickle.load(pkl_file) except EOFError: whois = {} except IOError: whois = {} def usage(): print('%s version %1.1f\n' % (__PROGNAME__, __version__)) print('usage: %s [-h] [-q] [-a] [-s server] [-p port] [-c count] [-t type] [-w wait] hostname' % __PROGNAME__) print(' -h --help Show this help') print(' -q --quiet Quiet') print(' -e --expert Print expert hints if available') print(' -a --asn Turn on AS# lookups for each hop encountered') print(' -s --server DNS server to use (default: first system resolver)') print(' -p --port DNS server port number (default: 53)') print(' -c --count Maximum number of hops (default: 30)') print(' -w --wait Maximum wait time for a reply (default: 5)') print(' -t --type DNS request record type (default: A)') print(' -C --color Print colorful output') print(' ') sys.exit() def signal_handler(sig, frame): global shutdown if shutdown: # pressed twice, so exit immediately sys.exit(0) shutdown = True # pressed once, exit gracefully def expert_report(trace_path, color_mode): color = Colors(color_mode) print("\n%s=== Expert Hints ===%s" % (color.B, color.N)) if len(trace_path) == 0: print(" [*] empty trace - should not happen") return prev_hop = None if len(trace_path) > 1: prev_hop = trace_path[-2] if len(trace_path) < 2: print( " %s[*]%s path too short (possible DNS hijacking, unless it is a local DNS resolver)" % (color.R, color.N)) return if prev_hop == '*': print(" %s[*]%s public DNS server is next to an invisible hop (probably a firewall)" % (color.R, color.N)) return if prev_hop and ipaddress.ip_address(prev_hop).is_private: print(" %s[*]%s public DNS server is next to a private IP address (possible hijacking)" % (color.R, color.N)) return if prev_hop and ipaddress.ip_address(prev_hop).is_reserved: print(" %s[*]%s public DNS server is next to a reserved IP address (possible hijacking)" % (color.R, color.N)) return # no expert info available print(" %s[*]%s No expert hint available for this trace" % (color.G, color.N)) def ping(resolver, hostname, dnsrecord, ttl): global _ttl reached = False dns.query.socket_factory = CustomSocket _ttl = ttl try: resolver.query(hostname, dnsrecord) except dns.resolver.NoNameservers as e: if not quiet: print("no or bad response:", e) sys.exit(1) except dns.resolver.NXDOMAIN as e: if not quiet: print("Invalid hostname:", e) sys.exit(1) except dns.resolver.Timeout: pass except dns.resolver.NoAnswer: if not quiet: print("invalid answer") pass except SystemExit: pass except: print("unxpected error: ", sys.exc_info()[0]) sys.exit(1) else: reached = True return reached def main(): global quiet try: signal.signal(signal.SIGTSTP, signal.SIG_IGN) # ignore CTRL+Z signal.signal(signal.SIGINT, signal_handler) # custom CTRL+C handler except AttributeError: # not all signals are supported on all platforms pass if len(sys.argv) == 1: usage() dnsrecord = 'A' count = 30 timeout = 1 dnsserver = dns.resolver.get_default_resolver().nameservers[0] dest_port = 53 hops = 0 as_lookup = False expert_mode = False should_resolve = True color_mode = False try: opts, args = getopt.getopt(sys.argv[1:], "aqhc:s:t:w:p:neC", ["help", "count=", "server=", "quiet", "type=", "wait=", "asn", "port", "expert", "color"]) except getopt.GetoptError as err: # print help information and exit: print(err) # will print something like "option -a not recognized" usage() if args and len(args) == 1: hostname = args[0] else: usage() for o, a in opts: if o in ("-h", "--help"): usage() elif o in ("-c", "--count"): count = int(a) elif o in ("-e", "--expert"): expert_mode = True elif o in ("-s", "--server"): dnsserver = a elif o in ("-q", "--quiet"): quiet = True elif o in ("-w", "--wait"): timeout = int(a) elif o in ("-t", "--type"): dnsrecord = a elif o in ("-p", "--port"): dest_port = int(a) elif o in ("-C", "--color"): color_mode = True elif o in ("-n"): should_resolve = False elif o in ("-a", "--asn"): as_lookup = True else: usage() color = Colors(color_mode) resolver = dns.resolver.Resolver() resolver.nameservers = [dnsserver] resolver.timeout = timeout resolver.lifetime = timeout resolver.retry_servfail = 0 icmp = socket.getprotobyname('icmp') ttl = 1 reached = False trace_path = [] if not quiet: print("%s DNS: %s:%d, hostname: %s, rdatatype: %s" % (__PROGNAME__, dnsserver, dest_port, hostname, dnsrecord)) while True: if shutdown: break # some platforms permit opening a DGRAM socket for ICMP without root permission # if not availble, we will fall back to RAW which explicitly requires root permission try: icmp_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, icmp) except OSError: try: icmp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, icmp) except OSError: print("Error: Unable to create ICMP socket with unprivileged user. Please run as root.") sys.exit(1) icmp_socket.bind(("", dest_port)) icmp_socket.settimeout(timeout) curr_addr = None curr_host = None with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool: # dispatch dns lookup to another thread stime = time.time() thr = pool.submit(ping, resolver, hostname, dnsrecord, ttl) try: # expect ICMP response _, curr_addr = icmp_socket.recvfrom(512) curr_addr = curr_addr[0] except socket.error: etime = time.time() pass finally: etime = time.time() icmp_socket.close() reached = thr.result() if reached: curr_addr = dnsserver stime = time.time() # need to recalculate elapsed time for last hop without waiting for an icmp error reply ping(resolver, hostname, dnsrecord, ttl) etime = time.time() elapsed = abs(etime - stime) * 1000 # convert to milliseconds if should_resolve: try: if curr_addr: curr_name = socket.gethostbyaddr(curr_addr)[0] except socket.error: curr_name = curr_addr except SystemExit: pass except: print("unxpected error: ", sys.exc_info()[0]) else: curr_name = curr_addr if curr_addr: as_name = "" if as_lookup: asn = whoisrecord(curr_addr) as_name = '' try: if asn and asn.asn != "NA": as_name = "[%s %s] " % (asn.asn, asn.owner) except AttributeError: if shutdown: sys.exit(0) pass c = color.N # default if curr_addr != '*': IP = ipaddress.ip_address(curr_addr) if IP.is_private: c = color.R if IP.is_reserved: c = color.B if curr_addr == dnsserver: c = color.G print("%d\t%s (%s%s%s) %s%d ms" % (ttl, curr_name, c, curr_addr, color.N, as_name, elapsed), flush=True) trace_path.append(curr_addr) else: print("%d\t *" % ttl, flush=True) trace_path.append("*") ttl += 1 hops += 1 if (hops >= count) or (curr_addr == dnsserver) or reached: break if expert_mode and not shutdown: expert_report(trace_path, color_mode) if __name__ == '__main__': try: main() finally: pkl_file = open(WHOIS_CACHE, 'wb') pickle.dump(whois, pkl_file) dnsdiag-1.4.0/public-servers.txt000066400000000000000000000002251272777447000166530ustar00rootroot000000000000008.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844 4.2.2.1 4.2.2.2 4.2.2.3 4.2.2.4 4.2.2.5 209.244.0.3 209.244.0.4 195.46.39.39 195.46.39.40 dnsdiag-1.4.0/requirements.txt000066400000000000000000000000001272777447000164200ustar00rootroot00000000000000dnsdiag-1.4.0/setup.py000066400000000000000000000023531272777447000146630ustar00rootroot00000000000000from setuptools import setup, find_packages setup( name="dnsdiag", version="1.3.5", packages=find_packages(), classifiers=[ "Topic :: System :: Networking", "Environment :: Console", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Programming Language :: Python :: 3.4", "Topic :: Internet :: Name Service (DNS)", "Development Status :: 5 - Production/Stable", "Operating System :: OS Independent", ], author="Babak Farrokhi", author_email="babak@farrokhi.net", description="DNS Diagnostics and measurement tools (ping, traceroute)", long_description=""" DNSDiag provides a handful of tools to measure and diagnose your DNS performance and integrity. Using dnsping, dnstraceroute and dnseval tools you can measure your DNS response quality from delay and loss perspective as well as tracing the path your DNS query takes to get to DNS server. """, license="BSD", keywords="dns traceroute ping", url="https://dnsdiag.org/", entry_points={ 'console_scripts': [ 'dnsping = dnsping:main', 'dnstraceroute = dnstraceroute:main', 'dnseval = dnseval:main', ] } )