Wireshark-users: Re: [Wireshark-users] Any wireshark filter to differentiate between NXDOMAIN and
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 29 Mar 2017 11:32:36 +0200
Hi,

According to RFC 6895 that value (8) is used as RCODE for NXRRSET, so the filter

	dns.flags.rcode == 8

Should be fine. What Wireshark version are you using?

Thanks,
Jaap



> On 29 Mar 2017, at 10:23, Abdul Khader <akhader@xxxxxxxxxxxxxxx> wrote:
> 
> Dear All,
> 
> Any wireshark filter which would give me NXRRSET and does not include NXDOMAIN
> 
> To get NXDOMAIN, we can use dns.flags.rcode == 3
> 
> But how do we get NXRRSET ?
> 
> 
> dns.flags.rcode == 8 or dns.flags.rcode == 0x8  does not work.
>