Wireshark · Wireshark-users: Re: [Wireshark-users] Any wireshark filter to differentiate between NXDOMAIN and NXRRSET

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

According to RFC 6895 that value (8) is used as RCODE for NXRRSET, so the filter

	dns.flags.rcode == 8

Should be fine. What Wireshark version are you using?

Thanks,
Jaap



> On 29 Mar 2017, at 10:23, Abdul Khader <akhader@xxxxxxxxxxxxxxx> wrote:
> 
> Dear All,
> 
> Any wireshark filter which would give me NXRRSET and does not include NXDOMAIN
> 
> To get NXDOMAIN, we can use dns.flags.rcode == 3
> 
> But how do we get NXRRSET ?
> 
> 
> dns.flags.rcode == 8 or dns.flags.rcode == 0x8  does not work.
>