new: implemented dns packet parser

caplets/local-sniffer.cap

@@ -3,7 +3,7 @@ events.clear
 set events.stream.filter net.sniff
 events.stream on
 
-set net.sniffer.verbose true
+set net.sniffer.verbose false
 set net.sniffer.local true
 
 net.sniffer on

modules/net_sniff.go

@@ -25,7 +25,7 @@ func NewSniffer(s *session.Session) *Sniffer {
 
 	sniff.AddParam(session.NewBoolParameter("net.sniffer.verbose",
 		"true",
-		"Print captured packets to screen."))
+		"If true, will print every captured packet, otherwise only selected ones."))
 
 	sniff.AddParam(session.NewBoolParameter("net.sniffer.local",
 		"false",
@@ -117,11 +117,7 @@ func (s Sniffer) isLocalPacket(packet gopacket.Packet) bool {
 }
 
 func (s *Sniffer) onPacketMatched(pkt gopacket.Packet) {
-	if s.Ctx.Verbose == false {
+	if mainParser(pkt, s.Ctx.Verbose) == true {
-		return
-	}
-
-	if mainParser(pkt) == true {
 		s.Stats.NumDumped++
 	}
 }

modules/net_sniff_dns.go

@@ -0,0 +1,36 @@
+package modules
+
+import (
+	"fmt"
+
+	"github.com/evilsocket/bettercap-ng/core"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+func dnsParser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
+	dns, parsed := pkt.Layer(layers.LayerTypeDNS).(*layers.DNS)
+	if parsed == false {
+		return false
+	}
+
+	if dns.OpCode != layers.DNSOpCodeQuery || len(dns.Answers) == 0 {
+		return false
+	}
+
+	for _, a := range dns.Answers {
+		if a.IP == nil {
+			continue
+		}
+		fmt.Printf("[%s] %s %s > %s : %s is %s\n",
+			vTime(pkt.Metadata().Timestamp),
+			core.W(core.BG_DGRAY+core.FG_WHITE, "dns"),
+			vIP(ip.SrcIP),
+			vIP(ip.DstIP),
+			core.Yellow(string(a.Name)),
+			vIP(a.IP))
+	}
+
+	return true
+}

modules/net_sniff_parsers.go

@@ -10,13 +10,14 @@ import (
 	"github.com/google/gopacket/layers"
 )
 
-func tcpParser(ip *layers.IPv4, pkt gopacket.Packet) {
+func tcpParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
 	tcp := pkt.Layer(layers.LayerTypeTCP).(*layers.TCP)
 
 	if sniParser(ip, pkt, tcp) {
 		return
 	}
 
+	if verbose == true {
 		fmt.Printf("[%s] %s %s:%s > %s:%s %s\n",
 			vTime(pkt.Metadata().Timestamp),
 			core.W(core.BG_LBLUE+core.FG_BLACK, "tcp"),
@@ -26,10 +27,16 @@ func tcpParser(ip *layers.IPv4, pkt gopacket.Packet) {
 			vPort(tcp.DstPort),
 			core.Dim(fmt.Sprintf("%d bytes", len(ip.Payload))))
 	}
+}
 
-func udpParser(ip *layers.IPv4, pkt gopacket.Packet) {
+func udpParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
 	udp := pkt.Layer(layers.LayerTypeUDP).(*layers.UDP)
 
+	if dnsParser(ip, pkt, udp) {
+		return
+	}
+
+	if verbose == true {
 		fmt.Printf("[%s] %s %s:%s > %s:%s %s\n",
 			vTime(pkt.Metadata().Timestamp),
 			core.W(core.BG_DGRAY+core.FG_WHITE, "udp"),
@@ -39,8 +46,10 @@ func udpParser(ip *layers.IPv4, pkt gopacket.Packet) {
 			vPort(udp.DstPort),
 			core.Dim(fmt.Sprintf("%d bytes", len(ip.Payload))))
 	}
+}
 
-func unkParser(ip *layers.IPv4, pkt gopacket.Packet) {
+func unkParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
+	if verbose == true {
 		fmt.Printf("[%s] [%s] %s > %s (%d bytes)\n",
 			vTime(pkt.Metadata().Timestamp),
 			pkt.TransportLayer().LayerType(),
@@ -48,8 +57,9 @@ func unkParser(ip *layers.IPv4, pkt gopacket.Packet) {
 			vIP(ip.DstIP),
 			len(ip.Payload))
 	}
+}
 
-func mainParser(pkt gopacket.Packet) bool {
+func mainParser(pkt gopacket.Packet, verbose bool) bool {
 	nlayer := pkt.NetworkLayer()
 	if nlayer == nil {
 		log.Warning("Missing network layer skipping packet.")
@@ -70,11 +80,11 @@ func mainParser(pkt gopacket.Packet) bool {
 	}
 
 	if tlayer.LayerType() == layers.LayerTypeTCP {
-		tcpParser(ip, pkt)
+		tcpParser(ip, pkt, verbose)
 	} else if tlayer.LayerType() == layers.LayerTypeUDP {
-		udpParser(ip, pkt)
+		udpParser(ip, pkt, verbose)
 	} else {
-		unkParser(ip, pkt)
+		unkParser(ip, pkt, verbose)
 	}
 
 	return true

modules/net_sniff_views.go

@@ -17,7 +17,7 @@ func vTime(t time.Time) string {
 
 func vIP(ip net.IP) string {
 	if session.I.Interface.IP.Equal(ip) {
-		return core.Dim("-")
+		return core.Dim("local")
 	} else if session.I.Gateway.IP.Equal(ip) {
 		return "gateway"
 	}