Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Source: Grab the digit client DNS-over-TLS tool from the ISI website:
    http://www.isi.edu/ant/software/tdns/index.html
  • Query: Build digit with openssl:

    • create a file called queries containing a query name

    •  ./digit -f queries -r <serverIP> -V -t tcp     (to see TCP query)

    •  ./digit -f queries -r <serverIP> -V -t ssl      (to see DNS-over-TLS query) 

How to Decode TLS packets in Wireshark

If you want to decode the DNS packets in Wireshark (use 1.12.1 or later) to get support TLSv1.2

  • Obtain the server key file

  • Configure the key in wireshark in Edit->Preferences

    • open the protocol list in the right hand menu and select SSL from the list
    • Click on the RSA keys list 'Edit' box and then click on 'New' in the dialog that appears
      • Enter remote servers IP address and the port for TLS (1021), and 'http' or 'spdy' for the protocal (DNS is not yet available here).
      • Use the Key File selector to choose the key file you downloaded
    • Save this by hitting OK, OK and Apply.
    • Back in the main window use the Analyze->Decode as... option to choose to decode as SSL
    • Click on one of the packets labelled 'Application data' and you should see an additional tab appear in the Packet bytes view window of wireshark labelled "Decrypted SSL data".