Sample Header Ad - 728x90

How to parse strace recvfrom syscall?

3 votes
1 answer
980 views
I strace a curl command:
strace -s 2000 -f curl google.com
and see 2 DNS queries
recvfrom(3, "\302\325\201\200\0\1\0\1\0\0\0\0\6google\3com\0\0\34\0\1\6google\3com\0\0\34\0\1\0\0\0\362\0\20*\0\24P@\t\10\v\0\0\0\0\0\0 \16", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.65.7")}, [28->16]) = 66
recvfrom(3, "X\320\201\200\0\1\0\1\0\0\0\0\6google\3com\0\0\1\0\1\6google\3com\0\0\1\0\1\0\0\1)\0\4\216\372\263\356", 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.65.7")}, [28->16]) = 54
Then, I see a connect() syscall to 142.250.179.238 which is a Google's IP.
connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("142.250.179.238")}, 16) = 0
I believe one of the 2 recvfrom calls contains the IP "142.250.179.238", otherwise curl can't know the IP to connect to. **My question: What is the format of the 2 recvfrom strings? And how to parse it to get the IP address?**
"\302\325\201\200\0\1\0\1\0\0\0\0\6google\3com\0\0\34\0\1\6google\3com\0\0\34\0\1\0\0\0\362\0\20*\0\24P@\t\10\v\0\0\0\0\0\0 \16"
"X\320\201\200\0\1\0\1\0\0\0\0\6google\3com\0\0\1\0\1\6google\3com\0\0\1\0\1\0\0\1)\0\4\216\372\263\356"
Asked by Rocherlee (133 rep)
Dec 3, 2023, 03:14 PM
Last activity: Dec 3, 2023, 10:40 PM