From e95657b2582b36a6d2852a20b1d2bff022aa7960 Mon Sep 17 00:00:00 2001 From: yubiuser Date: Wed, 2 Feb 2022 13:53:55 +0100 Subject: [PATCH] FTL internal package dump (#638) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * FTL internal package dump Signed-off-by: Christian König * Shorten name Signed-off-by: Christian König * Restructure FTL menu Signed-off-by: Christian König --- docs/ftldns/package_dump.md | 34 ++++++++++++++++++++++++++++++++++ mkdocs.yml | 18 ++++++++++-------- 2 files changed, 44 insertions(+), 8 deletions(-) create mode 100644 docs/ftldns/package_dump.md diff --git a/docs/ftldns/package_dump.md b/docs/ftldns/package_dump.md new file mode 100644 index 0000000..1319e4f --- /dev/null +++ b/docs/ftldns/package_dump.md @@ -0,0 +1,34 @@ +## Pi-hole FTL's internal pcap packet dump + +Pi-hole has its own embedded package dumping. It can be enabled by adding the following to a file like `/etc/dnsmasq.d/99-record.conf`: + +``` +dumpfile=/etc/pihole/dump.pcap +``` + +(or any other location you prefer), in addition to + +``` +dumpmask= +``` + +where `mask` specifies which types of packets should be added to the dumpfile defined above. The argument should be the OR of the bitmasks for each type of packet to be dumped: it can be specified in hex by preceding the number with 0x in the normal way. +Each time a packet is written to the dumpfile, we log the packet sequence and the mask representing its type. The current types are: + +- `0x0001` - DNS queries from clients +- `0x0002` - DNS replies to clients +- `0x0004` - DNS queries to upstream +- `0x0008` - DNS replies from upstream +- `0x0010` - queries send upstream for DNSSEC validation +- `0x0020` - replies to queries for DNSSEC validation +- `0x0040` - replies to client queries which fail DNSSEC validation +- `0x0080` - replies to queries for DNSSEC validation which fail validation. + +If you just want to record everything and later filter this in Wireshark you can just add the two lines + +``` +dumpfile=/etc/pihole/dump.pcap +dumpmask=0x00ff +``` + +{!abbreviations.md!} diff --git a/mkdocs.yml b/mkdocs.yml index 49c59e2..e839830 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -108,16 +108,18 @@ nav: - 'DNS cache': ftldns/dns-cache.md - 'Blocking mode': ftldns/blockingmode.md - 'Privacy levels': ftldns/privacylevels.md - - 'Telnet API': ftldns/telnet-api.md - - 'Signals': 'ftldns/signals.md' - 'Compatibility': ftldns/compatibility.md - - 'Install from source': ftldns/compile.md - 'dnsmasq warnings': ftldns/dnsmasq_warn.md - - 'Cache dump': ftldns/cache_dump.md - - 'Debugging FTLDNS': - - 'gdb': ftldns/debugging.md - - 'valgrind': ftldns/valgrind.md - - 'In-depth manual': ftldns/in-depth.md + - 'Advanced': + - 'Install from source': ftldns/compile.md + - 'Telnet API': ftldns/telnet-api.md + - 'Signals': 'ftldns/signals.md' + - 'Cache dump': ftldns/cache_dump.md + - 'Packet dump': ftldns/package_dump.md + - 'Debugging': + - 'gdb': ftldns/debugging.md + - 'valgrind': ftldns/valgrind.md + - 'In-depth manual': ftldns/in-depth.md - 'RegEx blocking': - "Overview": regex/overview.md - "Testing": regex/testmode.md