Get a list of all domain names from DNS queries in a tcpdump capture file.

gistfile1.py

import struct


def dns(capturefile, outputfile):
    domains = []
    cap = open(capturefile, 'rb')
    cap.read(24)
    try:
        while True:
            cap.read(8)
            packetlen = struct.unpack('<I', cap.read(4))[0]
            cap.read(4)
            packet = cap.read(packetlen).encode('hex')
            if packet[46:48] == '11' and packet[74:76] == '35' and packet[88:90] == '01':
                name = ""
                fqdn = packet[108:-8]
                while fqdn and fqdn[:2] != '00':
                    readlen = int(fqdn[:2], 16) * 2
                    fqdn = fqdn[2:]
                    name += fqdn[:readlen].decode('hex')
                    name += "."
                    fqdn = fqdn[readlen:]
                domains.append(name)
    except struct.error:
        pass
    cap.close()
    outfile = open(outputfile, 'w')
    outfile.writelines([i[:-1] + '\n' for i in set(domains)])

if __name__ == "__main__":
    dns('capture.pcap', 'domains.txt')