anyone familiar with nemesis dns?

[Mykol]

I'm generating custom packets to test some IDS rules and using nemesis dns, in this case. The documentation says I can feed it a payload file (which is perfect, 'cause I can then tweak specific things in there that I want to look at) -- but it doesn't say what form the payload file should be in. ascii doesn't seem to be working...

MAN says:
"The payload file can consist of any arbitary data though it will be most useful to create a payload resembling the structure of the DNS packet specified using the command-line options. In order to send real DNS packets, a payload containing the appropriate record data (as specified in the DNS header) must be created manually." -- OK, did that. In fact, took a legitimate DNS query (ascii) and feed it that = malformed packets... according to WireShark.

Other switches for nemesis involve more basic settings, such as: source IP, dest IP, etc.

Other Internet searches come up with a cut-n-paste of the MAN page (gee, thanks!).

Anyone have experience with this?

Thanks!
Cheers,
~m

[SirDice]

Capture a real dns request and use the data in that packet. The payload should be binary data as it is in a regular request.