N3MAP(1)

NAME
n3map - Enumerate DNSSEC-enabled DNS zones

SYNOPSIS
n3map [options...] [-o file] [nameserver[:port]]... zone

DESCRIPTION
Enumerate DNSSEC-enabled DNS zones that use either NSEC or NSEC3 records.

  Enumeration Options

-a, --auto
    Automatically detect whether the zone uses NSEC or NSEC3 records (default).

-3, --nsec3
    Use NSEC3 Enumeration.

-n, --nsec
    Use NSEC Enumeration.

-o, --output=FILE
    Write the received records to FILE. If FILE is -, the records are written to standard output.

-i, --input=FILE
    Read a list of records from FILE and continue the enumeration. Such a file was typically generated by the --output option. In NSEC3 mode, the label counter value is also restored from FILE if present (see the --label-counter option).

-c, --continue=FILE
    Same as --input FILE --output FILE. Note that the original input file is regenerated which means that any additional comments you may have made in FILE will be lost.

  NSEC Options

-m, --query-mode=MODE
    Change the NSEC query mode/strategy. MODE may be one of the following:

    A: In this mode, only A queries are used. This mode is quite reliable, however, it may require a lot of additional queries in some situations.

    NSEC: This mode only uses NSEC queries. It uses only a minimum amount of queries. The downside is that this mode cannot be used on zones with subzones wich are served by the same nameserver since this would lead to an endless loop. If this situation is detected the enumeration will be aborted.

    mixed: This mode is the same as NSEC mode, however, it may use A queries to step over subzones. It uses less queries than the A mode and is currently the most reliable NSEC query mode. By default, this mode is used.

-M, --mixed
    Same as --query-mode=mixed.

-A  Same as --query-mode=A.

-N  Same as --query-mode=NSEC.

-b, --binary
    Use all possible binary values as domain names in queries (default).

    The DNS protocol allows any byte value in query names. However, queries containing non-printable characters are quite unusual and may easily be detected as an anomaly. See also the --ldh option.

-l, --ldh
    Use only lowercase ASCII characters, digits and the hyphen (-) in query names (known as the LDH rule).

    Using this option makes enumeration look less suspicious. The drawback is that it may step over (miss) domain names that use other characters. This option has no effect if the query mode is NSEC (see the --query-mode option for details).

-s, --start=NAME
    Instead of walking through the zone from the beginning, start at the domain NAME. NAME is interpreted relative to the zone name.

    Note that in NSEC and mixed query modes, the NAME has to actually exist in the zone. Otherwise it can be an arbitrary domain name. See also the --query-mode option.

-e, --end=NAME
    End as soon as enumeration reaches the domain NAME. NAME is interpreted relative to the zone name. The NAME may be an arbitrary domain name that does not need to actually exist in the zone.

  NSEC3 Options

-f, --aggressive=N
    send up to N queries in parallel. This may speed up the enumeration significantly if the DNS servers round-trip time is high. However, it will also cause n3map to make more queries than usual because it cannot completely avoid queries which resolve to the same NSEC3 records. Use with caution.

--ignore-overlapping
    Do not abort enumeration if overlapping NSEC3 records are received.

    Normally, overlapping NSEC3 records are a sign that the zone has changed during the enumeration process. If you specify this option you may end up with a NSEC3 chain that is not entirely correct when the enumeration ends (i.e., some records may be missing and others may have been deleted from the zone since).

    Note however that this option is especially useful when enumerating very large zones which change frequently (during enumeration) and whose enumeration would thus likely fail.

-p, --predict
    try to predict the size of the zone based on the records already received. Note that this option might slow down the enumeration process (experimental)

--processes=N
    Specifies the number of NSEC3 hash calculation processes to use. By default the number is the number of CPUs - 1 (minimum 1).

  Advanced NSEC3 Options
These options are for advanced users and are rarely needed. They should be used with caution.

--label-counter=N
    Set the initial label counter to N. The label counter is used to generate the next possible query name in NSEC3 mode. When continuing an enumeration, it is important to set the initial label counter to the last value tried before. Otherwise, it may take a long time to retry all the values which have already been tried in the previous run. However, you normally don't need to specify the label counter since it is automatically restored from the input file when present (see the --input option).

--queue-element-size=N
    Set the number of (domainname, hash) pairs in a single queue element. Setting this option on a low value increases synchronisation overhead. Setting it too high may result in a long delay before the enumeration is started, especially on older systems.

--no-openssl
    do not use OpenSSL for hashing (slower)

  General Options

-q, --quiet
    do not display progress information during enumeration

--limit-rate=rate{/s|/m|/h}
    Limit the maximum query rate. The Rate may be any positive floating-point number followed by a mandatory `/s', `/m' or `/h' suffix.

--timeout=TIME
    Specifies how long to wait for a response from a DNS server, in milliseconds.

--max-retries=N
    Specifies how many times to repeat a query if the first attempt has failed due to a response timeout.

--detection-attempts=N
    Specifies how many times to try zone type (NSEC/NSEC3) detection. N=0 specifies an unlimited number of attempts.

--omit-soa-check
    Do not check the SOA record of the zone before starting the enumeration. This option may be used if you wish to perform no unnecessary queries. However, it should be used with caution, especially when enumerating an NSEC zone.

--omit-dnskey-check
    Do not check the DNSKEY record of the zone before starting the enumeration. This option may be used if you wish to perform no unnecessary queries. However, it should be used with caution, as it may lead to problems when trying to enumerate a zone that is not actually DNSSEC-enabled.

-h, --help
    Display a help message on standard output and exit successfully.

--version
    Display version information on standard output and exit successfully.

-v, --verbose
    increase verbosity level (use multiple times for greater effect)

EXIT STATUS

0   if OK

1   if an error occurred

2   if a serious error occurred (e.g. error parsing the command line arguments)

EXAMPLES

A simple example:

    $ n3map -p ns1.example.com. example.com.

This will enumerate the zone example.com (if it is DNSSEC-enabled) using the nameserver ns1.example.com. It will automatically determine whether the zone uses NSEC or NSEC3 records. We also used the -p option so we can see the progress of the enumeration. If we want to see what happens in more detail, we can increase the verbosity using the -v option:

    $ n3map -pv ns1.example.com. example.com.

Next, we want to save all received NSEC or NSEC3 records to a file (which is what you usually want). The file will be called `records':

    $ n3map -pv ns1.example.com. example.com. -o records

You can always interrupt the enumeration by sending the SIGINT signal to the main process (usually this is achieved by pressing CTRl-C). If you have interrupted a session and want to continue where it stopped later, you may used the -c option:

    $ n3map -pv ns1.example.com. example.com. -o records
    [interrupt by pressing CTRL-C]
    $ n3map -pv ns1.example.com. example.com. -c records

The next example is a bit more sophisticated:

    $ n3map ns1.example.com. ns2.example.com:5353  example.com. -pv3o records.nsec3  --limit-rate 10/s

This command forces NSEC3 enumeration (the -3 option) and limits the query rate to a maximum of 10 queries / second. Note that we also specified a second nameserver using a different port (5353).

SEE ALSO
n3map-nsec3-lookup(1), n3map-hashcatify(1), n3map-johnify(1), dig(1)

BUGS

lot's of em.

It may use a huge amount of memory when enumerating large zones.

Reading large lists of records is slow.