On Ubuntu Xenial I want to use tcpdump to filter DNS responses with errors RCODes (ServFail, NXDomain, etc.). So every RCODEs except '0'.

(See IANA DNS RCodes)

So I have to use a filter based on the 11th byte in the UDP packet. The 4 low bits contains the RCODE. I want to test if the value is different than 0. So I left-shift by 4 bits to get only these 4 low bits.

This command doesn't work:

tcpdump port 53 and 'udp[11] << 4 > 0'

listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
  14:07:04.148693 IP ns-cache0.oleane.net.domain > 17799 2/0/0 CNAME video-stats.l.google.com., A (82)
  14:07:04.150768 IP ns-cache0.oleane.net.domain > 39389 2/0/0 CNAME video-stats.l.google.com., AAAA 2a00:1450:4007:812::200e (94)
  14:07:04.150798 IP ns-cache0.oleane.net.domain > 60219 NXDomain* 0/1/0 (104)
  14:07:04.152703 IP ns-cache0.oleane.net.domain > 3472 1/0/0 PTR ns-cache0.oleane.net. (75)

I also get NoError DNS responses...

But using this command works:

tcpdump port 53 and 'udp[11]&0x0F > 0'

listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
  14:07:42.014626 IP ns-cache0.oleane.net.domain > 44447 NXDomain 0/1/1 (109)
  14:07:42.016611 IP ns-cache0.oleane.net.domain > 57750 NXDomain* 0/1/0 (104)

Why is the left-shifting not working?


It's nowhere specified that the left shift is executed in an 8-bit register, and that the high bits are dropped. (In fact, the shift probably uses a register of whatever native size the machine has, e.g. 32 bit or 64 bit).

So don't use left shifts to try to mask out values...

  • Indeed you're right... The filtering seems to be done by the kernel : kernel.org/doc/Documentation/networking/filter.txt github.com/torvalds/linux/blob/… So yes, I will avoid left-shift. Thanks! – Jacques Aug 30 '17 at 7:27
  • Yet, it is used in the tcpdump manpage... :/ tcpdump.org/tcpdump_man.html#lbAF – Jacques Aug 30 '17 at 7:33
  • This example (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) does something different (hint: left shift is not used in a ... > 0 expression, but in a ... - ... expression). So don't use left shifts and comparison with zero to mask out values. Use left shift in other circumstances as appropriate. – dirkt Aug 30 '17 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.