Wireshark · Wireshark-users: Re: [Wireshark-users] Any wireshark filter to differentiate between NXDOMAIN and NXRRSET

[Abdul Khader <akhader@xxxxxxxxxxxxxxx>]

Hi,

I am using Version 2.2.5 (v2.2.5-0-g440fd4d).

dns.flags.rcode == 8 does not work. It's not giving any results.


Regards



On 3/29/2017 1:32 PM, Jaap Keuter wrote:
> Hi,
>
> According to RFC 6895 that value (8) is used as RCODE for NXRRSET, so the filter
>
> 	dns.flags.rcode == 8
>
> Should be fine. What Wireshark version are you using?
>
> Thanks,
> Jaap
>
>
>
> > On 29 Mar 2017, at 10:23, Abdul Khader <akhader@xxxxxxxxxxxxxxx> wrote:
> >
> > Dear All,
> >
> > Any wireshark filter which would give me NXRRSET and does not include NXDOMAIN
> >
> > To get NXDOMAIN, we can use dns.flags.rcode == 3
> >
> > But how do we get NXRRSET ?
> >
> >
> > dns.flags.rcode == 8 or dns.flags.rcode == 0x8  does not work.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
>               mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe