1

following is part of the output of tcpdump:

18:34:15.429373 IP (tos 0x0, ttl 64, id 56078, offset 0, flags [DF], proto UDP (17), length 92)
172.31.8.42.47412 > 172.31.0.2.53: 3383+ [1au] A? www.yahoo.com. (64)
18:34:15.431788 IP (tos 0x0, ttl 64, id 36898, offset 0, flags [none], proto UDP (17), length 129)
172.31.0.2.53 > 172.31.8.42.47412: 3383 3/0/1 www.yahoo.com. CNAME fd-fp3.wg1.b.yahoo.com., fd-fp3.wg1.b.yahoo.com. A 98.139.180.149, fd-fp3.wg1.b.yahoo.com. A 98.139.183.24 (101)

what is the meaning of 3383+, 3/0/1 and [1au]?

I have checked a lot documents for tcpdump, but cannot figure it out.

2

Respectively (i.e. in order):

id is the answer on a query with number [e.g.] 17991

  • a/ the number of answer records
  • /n the number of name server records
  • au the number of additional records

http://nil.uniza.sk/linux-howto/using-tcpdump-diagnostic-dns-debian

(Google result #2 for "tcpdump dns", also for "tcpdump dns format" which was an autocomplete suggestion).

OUTPUT FORMAT

UDP Name Server Requests

A few anomalies are checked and may result in extra fields enclosed in square brackets: If a query contains an answer, authority records or additional records section, ancount, nscount, or arcount are printed as `[na]', `[nn]' or `[nau]' where n is the appropriate count.

man tcpdump  # a primary source document for tcpdump

"id" is nowadays one of the randomized fields, although in the older examples you will see sequential IDs. This field could be used to distinguish different requests between the same parties, even when packets are re-ordered.

The response record counts look consistent to me.

I am not sure why your request is showing the "anomaly".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.