anyone familiar with nemesis dns?
I'm generating custom packets to test some IDS rules and using nemesis dns, in this case. The documentation says I can feed it a payload file (which is perfect, 'cause I can then tweak specific things in there that I want to look at) -- but it doesn't say what form the payload file should be in. ascii doesn't seem to be working...
MAN says:
"The payload file can consist of any arbitary data though it will be most useful to create a payload resembling the structure of the DNS packet specified using the command-line options. In order to send real DNS packets, a payload containing the appropriate record data (as specified in the DNS header) must be created manually." -- OK, did that. In fact, took a legitimate DNS query (ascii) and feed it that = malformed packets... according to WireShark.
Other switches for nemesis involve more basic settings, such as: source IP, dest IP, etc.
Other Internet searches come up with a cut-n-paste of the MAN page (gee, thanks!).
Anyone have experience with this?
Thanks!
Cheers,
~m