NAME

dnstable_lookup - lookup individual records in a dnstable data file or set of data files

SYNOPSIS

dnstable_lookup [-cCjJnRsu] [-aAbB datetime] [-i secs] [-t secs] [-O #] rrset <OWNER> [<RRTYPE> [<BAILIWICK>]]

dnstable_lookup [-cjJnRsu] [-aAbB datetime] [-i secs] [-t secs] [-O #] rdata ip <ADDRESS | RANGE | PREFIX>

dnstable_lookup [-cjJnRsu] [-aAbB datetime] [-i secs] [-t secs] [-O #] rdata raw <HEX STRING> [<RRTYPE>]

dnstable_lookup [-cCjJnRsu] [-aAbB datetime] [-i secs] [-t secs] [-O #] rdata name <RDATA NAME> [<RRTYPE>]

dnstable_lookup [-jJu] [-O #] time_range

dnstable_lookup [-jJu] [-O #] version [<ETYPE>]

DESCRIPTION

Looks up records in a dnstable data file or fileset. Results are printed to stdout in an ad-hoc text format or in JSON format if -j or -J are given. The matching may be done based on the date and time the DNS record was first and/or last observed.

dnstable_lookup rrset returns RRsets matching the specified owner name (wildcards permitted). A resource record type and bailiwick domain name can optionally be specified.

dnstable_lookup rdata ip returns A or AAAA type Resource Records matching the specified IP address, IP prefix, or IP range.

dnstable_lookup rdata raw returns Resource Records whose record data matches the specified data value, expressed as a hexadecimal string.

dnstable_lookup rdata name returns Resource Records whose record data matches the specified domain name (wildcards permitted).

dnstable_lookup time_range returns an entry containing the time range for data within the data file or fileset.

dnstable_lookup version returns version entries. The optional ETYPE parameter can be used to request a specific type’s version. ETYPE may be one of rrset, rrset_name, rdata, or rdata_name

OPTIONS

-a datetime

Select results with recorded first seen after this datetime. See the DATE TIME SPECIFICATION section below for details.

-A datetime

Select results with recorded last seen after this datetime. See the DATE TIME SPECIFICATION section below for details.

-b datetime

Select results with recorded last seen before this datetime. See the DATE TIME SPECIFICATION section below for details.

-B datetime

Select results with recorded first seen before this datetime. See the DATE TIME SPECIFICATION section below for details.

-c

This enables complete (strict) matching semantics so no entries with a first or last observed time outside the provided time range will be matched. By default, time-based filtering with -A and -B will select results if any of the time is within the range (even if some are outside the range). The -c means it will not output the entry if it was also seen outside the time range.

-C

Do all matching in a case-sensitive manner.

-i secs

Print query statistics to stderr every secs seconds. Implies -s.

-j

Use JSON format for output, with timestamps in epoch time (seconds since epoch). Default is dig presentation format. One JSON-formatted entry per line will be printed.

-J

Use JSON format for output, with timestamps in human time (RFC3339 format). Default is dig presentation format. One JSON-formatted entry per line will be printed.

-n

Do not output matching record results. Only the number of matching entries found is reported to stderr. (To see stats when using a JSON format, see the -s option.)

-R, --raw

When using a JSON format for output, add a hex representation of the raw rdata and the rrtype.

-s

Output query statistics to stderr at end.

-t secs

Limit query time to secs seconds.

-u

Output unaggregated results; default is aggregated results. This is only valid with a setfile.

-O #

Offset (e.g. skip) the first # results.

WILDCARDS

Wildcards may be used to match zero or more labels on the left-hand side or right-hand side of a rrset owner name or a rdata name.

Multiple or zero labels on a side may be matched by using an asterisk (*), e.g., "*.example.com" or "n.example.*".

Exactly one label on a side may be matched by using a plus sign (+), e.g., "+.example.com" or "n.example.+".

Matching labels only in a middle of a domain name is not supported. Partial label matches are not supported. The wildcards cannot be used on both sides of a domain name at the same time.

ENVIRONMENT VARIABLES

Exactly one of the following environment variables must be set in order to specify the dnstable data file(s) to query.

DNSTABLE_FNAME

Path to a single dnstable data file.

DNSTABLE_SETFILE

Path to a "set file", a text file containing a newline separated list of dnstable data files on the filesystem. Results from all of the data files will be merged.

DATE TIME SPECIFICATION

The -a, -A, -b, and -B options support various date or time formats.

The date may be represented using strptime(3) ISO 8601 date formats: %Y-%m-%d, %Y-%m-%d %H:%M:%S (space separated), %Y-%m-%dT%H:%M:%S ("T" separated), and %Y-%m-%dT%H:%M:%SZ ("T" separated with trailing "Z" for Zulu timezone).

The date may be represented using absolute Unix epoch time in seconds, e.g., 1577880000 for January 1, 2020 noon.

The date may be represented using negative relative numeric time in seconds such as "-300" is 5 minutes ago.

The date may be represented using timing mnemonics relative to current time: W for weeks, D for days, H for hours, M for minutes, and S for seconds. For example, "52w3d" would be one year and three days before the current date (to the second); and "4H30M" is four and a half hours before the current time. (The letters are case insensitive.)

Due to the parser design, it won’t accept a value of zero or "1970-01-01T00:00:00Z" or earlier.

EXAMPLES

$ export DNSTABLE_FNAME=/path/to/dns.mtbl

$ dnstable_lookup rrset www.example.com

$ dnstable_lookup rrset "www.*"

$ dnstable_lookup rrset +.example.com

$ dnstable_lookup rrset example.com ns com

$ dnstable_lookup rdata ip 192.0.2.1

$ dnstable_lookup rdata ip 198.51.100.0/24

$ dnstable_lookup rdata ip 203.0.113.1-203.0.113.100

$ dnstable_lookup -j rdata ip 2001:db8::/32

$ dnstable_lookup -R -j rdata ip 2001:db8::/32

$ dnstable_lookup -u rdata ip 2001:db8::/32

$ dnstable_lookup -O 10 rdata ip 2001:db8::/32

$ dnstable_lookup rdata raw c00505f1

$ dnstable_lookup rdata name BLACKHOLE-1.IANA.ORG

$ dnstable_lookup rdata name ns3.example.+

$ dnstable_lookup -B "2022-11-09 22:59:59" rrset example.com