From 26bb685194de968d46997af356ad36dcd57888f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Pedro?= Date: Sun, 21 Jun 2026 18:52:17 -0300 Subject: [PATCH] test(dns): add sample DNS pcap for offline demonstration A 2-packet Ethernet/IPv4/UDP capture (query + compressed A response for google.com) to reproduce and validate the DNS analyzer offline, with a README describing the expected output and the Wireshark cross-check. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/samples/README.md | 22 ++++++++++++++++++++++ docs/samples/dns_sample.pcap | Bin 0 -> 212 bytes 2 files changed, 22 insertions(+) create mode 100644 docs/samples/README.md create mode 100644 docs/samples/dns_sample.pcap diff --git a/docs/samples/README.md b/docs/samples/README.md new file mode 100644 index 00000000..faae7ddf --- /dev/null +++ b/docs/samples/README.md @@ -0,0 +1,22 @@ +# DNS sample capture + +`dns_sample.pcap` is a tiny, self-contained capture used to demonstrate and +validate the DNS analyzer offline (no live traffic needed). + +It contains two Ethernet/IPv4/UDP frames on port 53: + +1. **Query** — `google.com`, type A (transaction id `0x1234`). +2. **Response** — `google.com` A → `8.8.8.8`, TTL 300, using a DNS + name-compression pointer; sent ~18 ms after the query. + +## How to use + +1. Open Sniffnet and import this file (capture from file). +2. Open the **DNS** tab: you should see one `Q` and one `R` row for + `google.com`, type `A`, RCODE `NOERROR`, the answer `8.8.8.8`, and a + resolution latency of ~18 ms. +3. Optionally open the same file in Wireshark and compare the dissected + fields (id, flags, QNAME, QTYPE, RCODE, RDATA) — they must match. + +The same byte vectors are exercised by the unit tests in +`src/networking/dns/parser.rs`. diff --git a/docs/samples/dns_sample.pcap b/docs/samples/dns_sample.pcap new file mode 100644 index 0000000000000000000000000000000000000000..b4bc30d3fc83050468b0a51af3ff3cf32e6d1900 GIT binary patch literal 212 zcmca|c+)~A1{MYw`2U}Qff2;{7@P{C+@P2V#Q6s%895kS85k@C1sxb11S4J@Si!)= z0R-n;7)%*d7#M_1fcn8kFfg#C=jW&Aq%tSx=Yqr-L8b-(jSK@C2Eq{YAZCM2^-xj* mnd*KLWFp9922-H9CLmKA8^9(2b)lPjfCnPOsKdYl(gy&S#v#N2 literal 0 HcmV?d00001